Add files via upload

PYAS.py

@@ -26,6 +26,7 @@ try:
     start_m = time.time()
     import os, sys, psutil, subprocess, threading, configparser, datetime
     from pefile import PE, DIRECTORY_ENTRY
+    from win10toast import ToastNotifier
     from hashlib import md5, sha1, sha256
     from PYAS_English import english_list
     from PyQt5.QtWidgets import *
@@ -1055,7 +1056,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
     def Virus_Solve(self):
         try:
             for line in self.Virus_List:
-                if 'C:/Windows' in str(line) or 'Dev-Cpp' in str(line) or 'Opengl' in str(line):
+                if ':/Windows' in str(line):
                     pass
                 else:
                     self.ui.Virus_Scan_text.setText(self.text_Translate('正在刪除: ')+str(line))
@@ -1091,31 +1092,28 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
             pyas_bug_log(e)
             return 0
 
-    def pyas_scan_start(self,file,rfp):
+    def pyas_scan_start(self,file,rfp):#MD5較驗
         try:
             with open(file,"rb") as f:
                 if str(md5(f.read()).hexdigest())[:10] in str(rfp):
                     f.close()
-                    return True
+                    return True#回傳是病毒
                 else:
-                    return False
+                    return False#回傳不是病毒
         except:
-            return False
+            return False#回傳不是病毒
         
-    def pyas_sign_start(self,file):
+    def pyas_sign_start(self,file):#簽名檢查
         try:
             pe = PE(file,fast_load=True)
             if pe.OPTIONAL_HEADER.DATA_DIRECTORY[DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_SECURITY']].VirtualAddress == 0:
                 pe.close()
-                #print('UNsign: '+file)
-                return True
+                return True#回傳未簽名
             else:
                 pe.close()
-                #print('sign: '+file)
-                return False
+                return False#回傳已簽名
         except:
-            #print('ERsign: '+file)
-            return True
+            return True#回傳未簽名
         
     #定義紀錄掃描
     def pyas_scan_write_en(self,file):
@@ -1164,6 +1162,8 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
             ft.close()
         except:
             pass
+
+    def pyas_del_virus_temp(self):
         try:
             os.remove('Library/PYAS/Temp/PYASV.tmp')
         except:
@@ -1173,6 +1173,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
     
     def File_Scan(self):
         print('[SCAN] Start Scan Action (File Scan)')
+        self.pyas_del_virus_temp()
         self.ui.Virus_Scan_choose_widget.hide()
         self.ui.Virus_Scan_Solve_Button.hide()
         self.ui.Virus_Scan_ProgressBar.hide()
@@ -1182,103 +1183,59 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
         self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
         file, filetype= QFileDialog.getOpenFileName(self,self.text_Translate("病毒掃描"),"C:/",'')
         try:
-            os.remove('Library/PYAS/Temp/PYASV.tmp')
-        except:
-            pass
-        if file != "":
-            try:
+            if file != "":
                 self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中，請稍後..."))
                 self.Virus_Scan = 1
                 self.ui.Virus_Scan_choose_Button.hide()
                 QApplication.processEvents()
-                try:
-                    print('[INFO] Reading Viruslist Database')
-                    with open('Library/PYAE/Hashes/Viruslist.md5','r') as fp:
-                        rfp = fp.read()
-                    fp.close()
-                    if self.show_virus_scan_progress_bar != 0:
-                        with open('Library/PYAE/Function/Viruslist.func','r') as fn:
-                            rfn = fn.read()
-                        fn.close()
-                    else:
-                        rfn = ''
-                except Exception as e:
-                    pyas_bug_log(e)
-                if self.show_virus_scan_progress_bar == 0:
-                    if self.pyas_sign_start(file):
-                        if self.pyas_scan_start(file,rfp):
-                            self.pyas_scan_write_en(file)
+                print('[INFO] Reading Viruslist Database')#讀取
+                with open('Library/PYAE/Hashes/Viruslist.md5','r') as fp:
+                    rfp = fp.read()
+                fp.close()
+                if self.show_virus_scan_progress_bar != 0:
+                    with open('Library/PYAE/Function/Viruslist.func','r') as fn:
+                        rfn = fn.read()
+                    fn.close()
+                else:
+                    rfn = ''
+                if self.show_virus_scan_progress_bar == 0:#確認是否高靈敏
+                    if self.pyas_sign_start(file):#簽名檢查
+                        if self.pyas_scan_start(file,rfp):#MD5較驗
+                            self.pyas_scan_write_en(file)#寫入發現病毒
                             self.ui.Virus_Scan_text.setText(self.text_Translate("✖當前已發現惡意軟體。"))
                 else:
-                    fts = False
                     try:
-                        if self.pyas_sign_start(file):
+                        if self.pyas_scan_start(file,rfp):#MD5較驗
+                            self.pyas_scan_write_en(file)#寫入發現病毒
+                            self.ui.Virus_Scan_text.setText(self.text_Translate("✖當前已發現惡意軟體。"))
+                        else:#未發現病毒
+                            fts = False
                             pe = PE(file)
-                            for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                            for entry in pe.DIRECTORY_ENTRY_IMPORT:#函數檢測
                                 for function in entry.imports:
                                     if fts != True:
                                         if str(function.name.decode('utf-8')) in rfn:
                                             fts = True
                             pe.close()
                             if fts:
-                                self.pyas_scan_write_en(file)
+                                self.pyas_scan_write_en(file)#寫入發現病毒
                                 fts = False
                                 print('[SCAN] Malware has been detected')
                                 self.ui.Virus_Scan_text.setText(self.text_Translate("✖當前已發現惡意軟體。"))
                     except:
                         pass
                 self.pyas_scan_answer_en()
-            except Exception as e:
-                pyas_bug_log(e)
-                QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
-        else:
-            self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
+            else:
+                self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
+        except Exception as e:
+            pyas_bug_log(e)
+            QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
 
 ##################################### 路徑掃描 #####################################
     
-    def pyas_scan_path_en(self,path,rfp,rfn,fts):
-        try:
-            for fd in os.listdir(path):
-                try:
-                    if self.Virus_Scan == 0:
-                        self.ui.Virus_Scan_Break_Button.hide()
-                        break
-                    else:
-                        fullpath = os.path.join(path,fd)
-                        if os.path.isdir(fullpath):
-                            self.pyas_scan_path_en(fullpath,rfp,rfn,fts)
-                        else:
-                            try:
-                                self.ui.Virus_Scan_text.setText(self.text_Translate("正在掃描: ")+fullpath)
-                                QApplication.processEvents()
-                                if self.show_virus_scan_progress_bar == 0:
-                                    if self.pyas_sign_start(fullpath):
-                                        if self.pyas_scan_start(fullpath,rfp):
-                                            self.pyas_scan_write_en(fullpath)
-                                else:
-                                    if self.pyas_scan_start(fullpath,rfp):
-                                        self.pyas_scan_write_en(fullpath)
-                                    else:
-                                        pe = PE(fullpath)
-                                        for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                                            for function in entry.imports:
-                                                    if fts != True:
-                                                        if str(function.name.decode('utf-8')) in rfn:
-                                                            fts = True
-                                        pe.close()
-                                        if fts:
-                                            self.pyas_scan_write_en(fullpath)
-                                            fts = False
-                            except:
-                                pass
-                except:
-                    continue
-        except Exception as e:
-            pyas_bug_log(e)
-            pass
-
     def Path_Scan(self):
         print('[SCAN] Start Scan Action (Path Scan)')
+        self.pyas_del_virus_temp()
         self.ui.Virus_Scan_choose_widget.hide()
         self.ui.Virus_Scan_Solve_Button.hide()
         self.ui.Virus_Scan_ProgressBar.hide()
@@ -1291,43 +1248,77 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
         self.Virus_List_output=QStringListModel()
         self.Virus_List_output.setStringList(self.Virus_List)
         self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
-        file = QFileDialog.getExistingDirectory(self,self.text_Translate("病毒掃描"),"C:/") 
+        file = QFileDialog.getExistingDirectory(self,self.text_Translate("病毒掃描"),"C:/")
         try:
-            os.remove('Library/PYAS/Temp/PYASV.tmp')
-        except:
-            pass
-        if file != "":
-            try:
+            if file != "":
                 self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中，請稍後..."))
                 self.Virus_Scan = 1
                 self.ui.Virus_Scan_choose_Button.hide()
                 self.ui.Virus_Scan_Break_Button.show()
                 QApplication.processEvents()
-                try:
-                    print('[INFO] Reading Viruslist Database')
-                    with open('Library/PYAE/Hashes/Viruslist.md5','r') as fp:
-                        rfp = fp.read()
-                    fp.close()
-                    if self.show_virus_scan_progress_bar != 0:
-                        with open('Library/PYAE/Function/Viruslist.func','r') as fn:
-                            rfn = fn.read()
-                        fn.close()
-                    else:
-                        rfn = ''
-                except Exception as e:
-                    pyas_bug_log(e)
+                print('[INFO] Reading Viruslist Database')#讀取
+                with open('Library/PYAE/Hashes/Viruslist.md5','r') as fp:
+                    rfp = fp.read()
+                fp.close()
+                if self.show_virus_scan_progress_bar != 0:
+                    with open('Library/PYAE/Function/Viruslist.func','r') as fn:
+                        rfn = fn.read()
+                    fn.close()
+                else:
+                    rfn = ''
                 self.pyas_scan_path_en(file,rfp,rfn,False)
                 self.pyas_scan_answer_en()
-            except Exception as e:
-                pyas_bug_log(e)
-                QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
-        else:
-            self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
+            else:
+                self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
+        except Exception as e:
+            pyas_bug_log(e)
+            QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
+
+    def pyas_scan_path_en(self,path,rfp,rfn,fts):
+        try:
+            for fd in os.listdir(path):#遍歷檔案
+                try:
+                    if self.Virus_Scan == 0:
+                        self.ui.Virus_Scan_Break_Button.hide()
+                        break
+                    else:
+                        fullpath = str(os.path.join(path,fd)).replace("\\", "/")
+                        if os.path.isdir(fullpath):#資料夾 深入遍歷
+                            self.pyas_scan_path_en(fullpath,rfp,rfn,fts)
+                        else:#檔案
+                            try:
+                                self.ui.Virus_Scan_text.setText(self.text_Translate("正在掃描: ")+fullpath)
+                                QApplication.processEvents()
+                                if self.show_virus_scan_progress_bar == 0:#確認是否高靈敏
+                                    if self.pyas_sign_start(fullpath):#簽名檢查
+                                        if self.pyas_scan_start(fullpath,rfp):#MD5較驗
+                                            self.pyas_scan_write_en(fullpath)#寫入發現病毒
+                                else:
+                                    if self.pyas_scan_start(fullpath,rfp):#MD5較驗
+                                        self.pyas_scan_write_en(fullpath)#寫入發現病毒
+                                    else:
+                                        pe = PE(fullpath)#函數檢測
+                                        for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                                            for function in entry.imports:
+                                                if fts != True:
+                                                    if str(function.name.decode('utf-8')) in rfn:
+                                                        fts = True
+                                        pe.close()
+                                        if fts:
+                                            self.pyas_scan_write_en(fullpath)#寫入發現病毒
+                                            fts = False
+                            except:
+                                pass
+                except:
+                    continue
+        except:
+            pass
 
 ##################################### 全盤掃描 #####################################
     
     def pyas_scan_disk_init_en(self):
         print('[SCAN] Start Scan Action (Disk Scan)')
+        self.pyas_del_virus_temp()
         self.Virus_Scan = 1
         self.ui.Virus_Scan_choose_widget.hide()
         self.ui.Virus_Scan_Solve_Button.hide()
@@ -1339,46 +1330,15 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
         self.Virus_List_output.setStringList(self.Virus_List)
         self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
         self.scaning = self.text_Translate("正在掃描: ")
-        try:
-            os.remove('Library/PYAS/Temp/PYASV.tmp')
-        except:
-            pass
         try:
             self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中，請稍後..."))
             QApplication.processEvents()
-            try:
-                print('[INFO] Reading Viruslist Database')
-                with open('Library/PYAE/Hashes/Viruslist.md5','r') as self.fp:
-                    rfp = self.fp.read()
-                self.fp.close()
-            except Exception as e:
-                pyas_bug_log(e)
-            self.pyas_scan_disk_en('A:/',rfp)
-            self.pyas_scan_disk_en('B:/',rfp)
-            self.pyas_scan_disk_en('C:/',rfp)
-            self.pyas_scan_disk_en('D:/',rfp)
-            self.pyas_scan_disk_en('E:/',rfp)
-            self.pyas_scan_disk_en('F:/',rfp)
-            self.pyas_scan_disk_en('G:/',rfp)
-            self.pyas_scan_disk_en('H:/',rfp)
-            self.pyas_scan_disk_en('I:/',rfp)
-            self.pyas_scan_disk_en('J:/',rfp)
-            self.pyas_scan_disk_en('K:/',rfp)
-            self.pyas_scan_disk_en('L:/',rfp)
-            self.pyas_scan_disk_en('M:/',rfp)
-            self.pyas_scan_disk_en('N:/',rfp)
-            self.pyas_scan_disk_en('O:/',rfp)
-            self.pyas_scan_disk_en('P:/',rfp)
-            self.pyas_scan_disk_en('Q:/',rfp)
-            self.pyas_scan_disk_en('R:/',rfp)
-            self.pyas_scan_disk_en('S:/',rfp)
-            self.pyas_scan_disk_en('T:/',rfp)
-            self.pyas_scan_disk_en('U:/',rfp)
-            self.pyas_scan_disk_en('V:/',rfp)
-            self.pyas_scan_disk_en('W:/',rfp)
-            self.pyas_scan_disk_en('X:/',rfp)
-            self.pyas_scan_disk_en('Y:/',rfp)
-            self.pyas_scan_disk_en('Z:/',rfp)
+            print('[INFO] Reading Viruslist Database')
+            with open('Library/PYAE/Hashes/Viruslist.md5','r') as self.fp:
+                rfp = self.fp.read()
+            self.fp.close()
+            for d in range(26):
+                self.pyas_scan_disk_en(str(chr(65+d))+':/',rfp)
             self.pyas_scan_answer_en()
         except Exception as e:
             pyas_bug_log(e)
@@ -1392,38 +1352,37 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
                         self.ui.Virus_Scan_Break_Button.hide()
                         break
                     else:
-                        fullpath = str(os.path.join(path,fd))
-                        if os.path.isdir(fullpath):
-                            self.pyas_scan_disk_en(fullpath,rfp)
-                        else:
-                            self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
-                            QApplication.processEvents()
-                            if self.show_virus_scan_progress_bar == 0:
-                                if 'C:/Windows' in fullpath or 'C:/$Recycle.Bin' in fullpath or 'AppData' in fullpath or 'C:/ProgramData' in fullpath:
-                                    pass
-                                else:
-                                    if 'C:/Program' in fullpath:
-                                        if 'Windows' in fullpath or 'Microsoft' in fullpath:
-                                            pass
-                                        else:
-                                            sflist = ['.exe','.dll']
-                                    else:
-                                        sflist = ['.exe','.dll','.com','.cmd','.bat','.vbs','.js','.scr']
-                                        #sflist = ['.exe','.dll','.com','.cmd','.bat','.msi','.reg',
-                                                  #'.vbs','.js','.jar','.py','.cpp','.htm','.html',
-                                                  #'.doc','.docx','.ppt','.pptx','.xls','.xlm','.pdf',
-                                                  #'.ico','.jpg','.png','.wav','.ogg','.mp3','.mp4',
-                                                  #'.zip','.7z','.rar','.gz','.tar','.wim','.iso',
-                                                  #'.inf','.ini','.tmp','.temp','.log','.scr']
-                                    root, extension = os.path.splitext(fd)
-                                    sfd = str(extension).lower()
-                                    if self.pyas_sign_start(fullpath) and sfd in sflist:
-                                        if self.pyas_scan_start(fullpath,rfp):
-                                            self.pyas_scan_write_en(fullpath)
+                        if self.show_virus_scan_progress_bar == 0:
+                            fullpath = str(os.path.join(path,fd)).replace("\\", "/")
+                            if ':/Windows' in fullpath or ':/$Recycle.Bin' in fullpath:#路徑過濾
+                                continue
+                            elif ':/Program' in fullpath or ':/Users/Default' in fullpath:
+                                sflist = ['.exe','.dll']
                             else:
+                                sflist = ['.exe','.dll','.com','.bat','.vbs','.scr','.cpl','.htm','.html']
+                            if os.path.isdir(fullpath):#資料夾 深入遍歷
+                                self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
+                                QApplication.processEvents()
+                                self.pyas_scan_disk_en(fullpath,rfp)
+                            else:#檔案
                                 root, extension = os.path.splitext(fd)
                                 sfd = str(extension).lower()
-                                if self.pyas_scan_start(fullpath,rfp):
+                                if self.pyas_sign_start(fullpath) and sfd in sflist:#簽名檢查+副檔名過濾檢測
+                                    self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
+                                    QApplication.processEvents()
+                                    if self.pyas_scan_start(fullpath,rfp):#MD5較驗
+                                        self.pyas_scan_write_en(fullpath)#寫入發現病毒
+                        else:
+                            fullpath = str(os.path.join(path,fd)).replace("\\", "/")
+                            if os.path.isdir(fullpath):#資料夾 深入遍歷
+                                self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
+                                QApplication.processEvents()
+                                self.pyas_scan_disk_en(fullpath,rfp)
+                            else:#檔案
+                                root, extension = os.path.splitext(fd)
+                                self.ui.Virus_Scan_text.setText(self.scaning+fullpath)
+                                QApplication.processEvents()
+                                if self.pyas_scan_start(fullpath,rfp):#簽名檢查(所有檔案類型都掃)
                                     self.pyas_scan_write_en(fullpath)
                 except:
                     continue
@@ -1755,11 +1714,11 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
     def Customize_REG_Command(self):
         import win32api,win32con
         continue_v = True
-        Value_name = self.ui.Value_Name_input.text()
-        Value_Path = self.ui.Value_Path_input.text()
-        Value_Data = self.ui.Value_Data_input.text()
-        Value_Type = self.ui.Value_Type_input.text()
-        Value_HEKY = self.ui.Value_HEKY_input.text()
+        Value_name = str(self.ui.Value_Name_input.text())
+        Value_Path = str(self.ui.Value_Path_input.text())
+        Value_Data = str(self.ui.Value_Data_input.text())
+        Value_Type = str(self.ui.Value_Type_input.text())
+        Value_HEKY = str(self.ui.Value_HEKY_input.text())
         if Value_HEKY == "HKEY_CLASSES_ROOT":
             Value_HEKY = win32con.HKEY_LOCAL_MACHINE
         elif Value_HEKY == "HKEY_CURRENT_USER":
@@ -1773,11 +1732,37 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
         else:
             QMessageBox.critical(self,self.text_Translate("錯誤"),self.text_Translate('錯誤: ')+self.text_Translate("您輸入了錯誤的HEKY"),QMessageBox.Ok)
             continue_v = False
+        if Value_Type == "REG_BINARY":
+            Value_Type = win32con.REG_BINARY
+        elif Value_Type == "REG_DWORD":
+            Value_Type = win32con.REG_DWORD
+        elif Value_Type == "REG_DWORD_LITTLE_ENDIAN":
+            Value_Type = win32con.REG_DWORD_LITTLE_ENDIAN
+        elif Value_Type == "REG_DWORD_BIG_ENDIAN":
+            Value_Type = win32con.REG_DWORD_BIG_ENDIAN
+        elif Value_Type == "REG_EXPAND_SZ":
+            Value_Type = win32con.REG_EXPAND_SZ
+        elif Value_Type == "REG_LINK":
+            Value_Type = win32con.REG_LINK
+        elif Value_Type == "REG_MULTI_SZ":
+            Value_Type = win32con.REG_MULTI_SZ
+        elif Value_Type == "REG_NONE":
+            Value_Type = win32con.REG_NONE
+        elif Value_Type == "REG_QWORD":
+            Value_Type = win32con.REG_QWORD
+        elif Value_Type == "REG_QWORD_LITTLE_ENDIAN":
+            Value_Type = win32con.REG_QWORD_LITTLE_ENDIAN
+        elif Value_Type == "REG_SZ":
+            Value_Type = win32con.REG_SZ
+        else:
+            QMessageBox.critical(self,self.text_Translate("錯誤"),self.text_Translate('錯誤: ')+self.text_Translate("您輸入了錯誤的TYPE"),QMessageBox.Ok)
+            continue_v = False
         if continue_v:
             if QMessageBox.warning(self,self.text_Translate("警告"),self.text_Translate("您確定要新增值或是修改值嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
                 try:
-                    key = win32api.RegOpenKey(Value_HEKY,Value_Path,0,win32con.KEY_ALL_ACCESS())
+                    key = win32api.RegOpenKey(Value_HEKY,Value_Path,0,win32con.KEY_ALL_ACCESS)
                     win32api.RegSetValueEx(key, Value_name,0,Value_Type,Value_Data)
+                    win32api.RegCloseKey(key)
                     QMessageBox.information(self,self.text_Translate("完成"),self.text_Translate("成功的創建或修改註冊表值"),QMessageBox.Ok)
                 except Exception as e:
                     QMessageBox.critical(self,self.text_Translate('錯誤'),self.text_Translate('錯誤: ')+str(e),QMessageBox.Ok)
@@ -1794,6 +1779,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
                             self.ui.Analyze_EXE_Output.append(str(function.name.decode('utf-8')))
                         except:
                             self.ui.Analyze_EXE_Output.append(str(function.name))
+                pe.close()
                 self.Change_Tools(self.ui.Analyze_EXE_widget)
                 QApplication.processEvents()
             else:
@@ -1823,6 +1809,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
                         self.ui.Analyze_EXE_Output.append(str(section.Name.decode('utf-8')) + str(hex(section.VirtualAddress)) + str(hex(section.Misc_VirtualSize)) + str(section.SizeOfRawData))
                     except:
                         self.ui.Analyze_EXE_Output.append(str(section.Name) + str(hex(section.VirtualAddress)) + str(hex(section.Misc_VirtualSize)) + str(section.SizeOfRawData))
+                pe.close()
                 self.Change_Tools(self.ui.Analyze_EXE_widget)
                 QApplication.processEvents()
 
@@ -1837,32 +1824,8 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
     def find_files_info_zh(self,ffile):
         try:
             start = time.time()
-            self.findfile_zh('A:/',ffile,start)
-            self.findfile_zh('B:/',ffile,start)
-            self.findfile_zh('C:/',ffile,start)
-            self.findfile_zh('D:/',ffile,start)
-            self.findfile_zh('E:/',ffile,start)
-            self.findfile_zh('F:/',ffile,start)
-            self.findfile_zh('G:/',ffile,start)
-            self.findfile_zh('H:/',ffile,start)
-            self.findfile_zh('I:/',ffile,start)
-            self.findfile_zh('J:/',ffile,start)
-            self.findfile_zh('K:/',ffile,start)
-            self.findfile_zh('L:/',ffile,start)
-            self.findfile_zh('M:/',ffile,start)
-            self.findfile_zh('N:/',ffile,start)
-            self.findfile_zh('O:/',ffile,start)
-            self.findfile_zh('P:/',ffile,start)
-            self.findfile_zh('Q:/',ffile,start)
-            self.findfile_zh('R:/',ffile,start)
-            self.findfile_zh('S:/',ffile,start)
-            self.findfile_zh('T:/',ffile,start)
-            self.findfile_zh('U:/',ffile,start)
-            self.findfile_zh('V:/',ffile,start)
-            self.findfile_zh('W:/',ffile,start)
-            self.findfile_zh('X:/',ffile,start)
-            self.findfile_zh('Y:/',ffile,start)
-            self.findfile_zh('Z:/',ffile,start)
+            for d in range(26):
+                self.findfile_zh(str(chr(65+d))+':/',ffile,start)
             end = time.time()
             if os.path.isfile('Library/PYAS/Temp/PYASF.tmp'):
                 try:
@@ -1892,12 +1855,9 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
             for fd in os.listdir(path):
                 try:
                     QApplication.processEvents()
-                    fullpath = os.path.join(path,fd)
-                    if 'C:/Windows' in fullpath or 'C:/$Recycle.Bin' in fullpath or 'C:/ProgramData' in fullpath or 'AppData' in fullpath or 'PerfLogs' in fullpath:
+                    fullpath = str(os.path.join(path,fd)).replace("\\", "/")
+                    if ':/Windows' in fullpath or ':/$Recycle.Bin' in fullpath or ':/ProgramData' in fullpath or 'AppData' in fullpath or 'PerfLogs' in fullpath:
                         pass
-                    elif 'C:/Program' in fullpath:
-                        if 'Windows' in fullpath or 'Microsoft' in fullpath:
-                            pass
                     else:
                         if os.path.isdir(fullpath):
                             self.findfile_zh(fullpath,ffile,start)
@@ -2121,21 +2081,25 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
                         if '' == file or 'C:\Windows' in file or 'C:\Program' in file or 'AppData' in file or 'MemCompression' in file or 'Registry' in file:
                             pass
                         else:
-                            if self.pyas_sign_start(file) and 'PYAS.exe' not in file:
+                            if self.pyas_sign_start(file) and 'PYAS' not in file:
                                 try:
                                     if subprocess.call('taskkill /f /im "'+str(p.name())+'" /t',shell=True) == 0:
                                         print('[INFO] Malware blocking success: '+str(p.name()))
                                         self.ui.State_output.append(self.text_Translate('{} > [實時防護] 成功攔截了一個惡意軟體:').format(str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')))+str(p.name()))
+                                        toaster = ToastNotifier()
+                                        toaster.show_toast("PYAS Security",self.text_Translate('{} > [實時防護] 成功攔截了一個惡意軟體:').format(str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')))+str(p.name()),icon_path="Library/PYAS/Icon/ICON.ico",duration=5,threaded=True)
                                     else:
                                         print('[INFO] Malware blocking failed: '+str(p.name()))
                                         self.ui.State_output.append(self.text_Translate('{} > [實時防護] 惡意軟體攔截失敗:').format(datetime.datetime.now())+str(p.name()))
+                                        toaster = ToastNotifier()
+                                        toaster.show_toast("PYAS Security",self.text_Translate('{} > [實時防護] 惡意軟體攔截失敗:').format(str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')))+str(p.name()),icon_path="Library/PYAS/Icon/ICON.ico",duration=5,threaded=True)
+                                    #os.remove(str(p.exe()))
                                     #try:
                                         #observer = Observer()
                                         #observer.schedule(MainWindow_Controller(), os.path.dirname(p.exe()), False)
                                         #observer.start()
                                     #except Exception as e:
                                         #pass
-                                    #os.remove(str(p.exe()))
                                 except Exception as e:
                                     pyas_bug_log(e)
                                     pass
@@ -2388,7 +2352,7 @@ if __name__ == '__main__':
         pyas_library()
         pyasb_remove()
         pyasp_remove()
-        pyas_version = "2.5.0"
+        pyas_version = "2.5.1"
         pyae_version = "2.2.1"
         threading.Thread(target = pyas_vl_update).start()
         QtCore.QCoreApplication.setAttribute(Qt.AA_EnableHighDpiScaling)# 自適應窗口縮放

PYAS_English.py

@@ -60,7 +60,9 @@ english_list = {
 "運行成功":"Run successfully",
 "不是有效命令":"Not a valid command",
 "您輸入了錯誤的HEKY":"You entered the wrong HEKY",
+"您輸入了錯誤的TYPE":"You entered the wrong TYPE",
 "警告":"Warning",
+"您確定要新增值或是修改值嗎?":"Are you sure you want to add or modify a value?",
 "成功的創建或修改註冊表值":"Successfully created or modified registry value",
 "分析文件函數":"Analyze File Func",
 "分析文件哈希值":"Analyze File Hashes",
@@ -84,6 +86,8 @@ english_list = {
 "启用该选项可以提高扫描灵敏度，但这也可能会造成误杀。":"Enable this option can improve scanning sensitivity, but it can also cause manslaughter.",
 '{} > [實時防護] 成功攔截了一個惡意軟體:':'{} > [Real-Time Protect] Malware blocking success:',
 '{} > [實時防護] 惡意軟體攔截失敗:':'{} > [Real-Time Protect] Malware blocking failed:',
+'{} > [實時防護] 正在檢測檔案安全性:':'{} > [Real-time Protect] Checking file security:',
+'{} > [實時防護] 未檢測到可疑檔案:':'{} > [Real-time Protect] No suspicious files detected:',
 '修復系統權限':"Repair System Permissions",
 '啟用該選項可以實時監控系統的檔案讀寫變更行為。':"Enable this option can improve scanning sensitivity, but it can also cause manslaughter.",
 'PYAS':"""PYAS Python Antivirus Software Security

PYAS_Version_File.py

@@ -1,7 +1,7 @@
 import pyinstaller_versionfile
 pyinstaller_versionfile.create_versionfile(
     output_file="versionfile.txt",
-    version='2.5.0',
+    version='2.5.1',
     company_name="PYAS Security",
     file_description="Python Antivirus Software",
     internal_name="PYAS",