Add files via upload

PYAS.py

@@ -5,6 +5,7 @@ import xml.etree.ElementTree as et
 from hashlib import md5, sha1, sha256
 from pefile import PE, DIRECTORY_ENTRY
 from PYAS_Language import translations
+from PYAS_Scripts import scripts_list
 from PYAS_Function import function_list
 from PYAS_Extension import slist, alist
 from PYAS_Interface import Ui_MainWindow
@@ -48,7 +49,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
         self.scan = False
         self.block_window = True
         self.pyas_opacity = 0
-        self.pyas_version = "2.7.9"
+        self.pyas_version = "2.8.1"
         self.ui.Theme_White.setChecked(True)
         self.pyas = str(sys.argv[0]).replace("\\", "/")
         self.key = self.pyas_key()
@@ -225,7 +226,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
 
     def lang_init_refresh(self):
         self.ui.State_title.setText(self.text_Translate("此裝置已受到防護" if self.safe else "此裝置當前不安全"))
-        self.ui.Window_title.setText(self.text_Translate(f"PYAS V{self.pyas_version} {self.key}"))
+        self.ui.Window_title.setText(self.text_Translate(f"PYAS V{self.pyas_version}"))
         self.ui.PYAS_CopyRight.setText(self.text_Translate(f"Copyright© 2020-{max(int(time.strftime('%Y')), 2020)} PYAS Security"))
         self.ui.State_Button.setText(self.text_Translate(" 狀態"))
         self.ui.Virus_Scan_Button.setText(self.text_Translate(" 掃描"))
@@ -536,6 +537,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
             self.mbr_protect = False
             self.reg_protect = False
             self.enh_protect = False
+            self.scan = False
             self.tray_icon.hide()
             self.hide_pyas_ui()
             QApplication.instance().quit()
@@ -559,17 +561,12 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
     def pyas_key(self):
         try:
             with open(self.pyas, "rb") as f:
-                file_md5 = str(md5(f.read()).hexdigest())
-            for url in ["http://27.147.30.238:5001/pyas","https://api.pyas.cf/pyas"]:
-                try:
-                    response = requests.get(url, params={"key": file_md5}, timeout=3)
-                    if response.status_code == 200 and response.text == "True":
-                        return ""
-                    else:
-                        return "(安全密鑰錯誤)"
-                except:
-                    pass
-            return "(網路連接錯誤)"
+                text = str(md5(f.read()).hexdigest())
+            response = requests.get("http://27.147.30.238:5001/pyas", params={"key": text}, timeout=3)
+            if response.status_code == 200 and response.text == "True":
+                return ""
+            else:
+                return "(安全密鑰錯誤)"
         except:
             return "(網路連接錯誤)"
 
@@ -659,14 +656,18 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
         self.ui.Virus_Scan_Solve_Button.hide()
         self.ui.Virus_Scan_choose_widget.hide()
         self.ui.Virus_Scan_choose_Button.hide()
+        self.ui.Virus_Scan_Break_Button.show()
         self.Virus_List_output=QStringListModel()
         self.Virus_List_output.setStringList(self.Virus_List)
         self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
+        self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中"))
+        QApplication.processEvents()
 
     def virus_scan_break(self):
         self.scan = False
         self.ui.Virus_Scan_Break_Button.hide()
         self.ui.Virus_Scan_choose_Button.show()
+        self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
 
     def virus_scan_choose_menu(self):
         if self.ui.Virus_Scan_choose_widget.isHidden():
@@ -685,86 +686,66 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
             pass
 
     def answer_scan(self):
-        if self.Virus_List != []:
+        if self.Virus_List == []:
+            self.system_safe()
+            self.virus_scan_break()
+            text = self.text_Translate("當前未發現病毒")
+        else:
+            self.virus_scan_break()
+            self.system_unsafe()
             self.Virus_List_output.setStringList(self.Virus_List_Ui)
             self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
             self.ui.Virus_Scan_Solve_Button.show()
-            self.virus_scan_break()
-            self.system_unsafe()
             text = self.text_Translate(f"當前發現 {len(self.Virus_List)} 個病毒")
-        else:
-            self.virus_scan_break()
-            self.system_safe()
-            text = self.text_Translate("當前未發現病毒")
         self.ui.Virus_Scan_text.setText(text)
         self.system_notification(text)
 
     def virus_solve(self):
         try:
-            for line in self.Virus_List:
+            for file in self.Virus_List:
                 try:
-                    self.ui.Virus_Scan_text.setText(self.text_Translate("正在刪除: ")+line)
+                    self.ui.Virus_Scan_text.setText(self.text_Translate("正在刪除: ")+file)
                     QApplication.processEvents()
-                    os.remove(str(line))
+                    os.remove(file)
                 except:
                     continue
+            self.system_safe()
             self.Virus_List = []
             self.Virus_List_Ui = []
+            self.ui.Virus_Scan_Solve_Button.hide()
             self.Virus_List_output.setStringList(self.Virus_List)
             self.ui.Virus_Scan_output.setModel(self.Virus_List_output)
             self.ui.Virus_Scan_text.setText(self.text_Translate("成功: 刪除成功"))
-            self.ui.Virus_Scan_Solve_Button.hide()
-            self.system_safe()
         except Exception as e:
             self.pyas_bug_log(e)
 
     def file_scan(self):
         try:
-            file, filetype= QFileDialog.getOpenFileName(self,self.text_Translate("病毒掃描"),"C:/","")
-            if file != "":
+            file, ftype = QFileDialog.getOpenFileName(self,self.text_Translate("病毒掃描"),"C:/")
+            if file:
                 self.init_scan()
-                self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中"))
-                QApplication.processEvents()
-                if file not in self.whitelist and ":/Windows" not in file:
-                    if self.high_sensitivity == 0 and self.sign_scan(file):
-                        if self.api_scan(file):
-                            self.write_scan(self.text_Translate("惡意"),file)
-                        elif self.pe_scan(file):
-                            self.write_scan(self.text_Translate("可疑"),file)
-                    elif self.high_sensitivity == 1:
-                        if self.api_scan(file):
-                            self.write_scan(self.text_Translate("惡意"),file)
-                        elif self.pe_scan(file):
-                            self.write_scan(self.text_Translate("可疑"),file)
+                self.start_scan(file)
                 self.answer_scan()
                 gc.collect()
         except Exception as e:
             self.pyas_bug_log(e)
             self.virus_scan_break()
-            self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
 
     def path_scan(self):
         try:
             path = QFileDialog.getExistingDirectory(self,self.text_Translate("病毒掃描"),"C:/")
-            if path != "":
+            if path:
                 self.init_scan()
-                self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中"))
-                self.ui.Virus_Scan_Break_Button.show()
-                QApplication.processEvents()
                 self.traverse_path(path)
                 self.answer_scan()
                 gc.collect()
         except Exception as e:
             self.pyas_bug_log(e)
             self.virus_scan_break()
-            self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
 
     def disk_scan(self):
         try:
             self.init_scan()
-            self.ui.Virus_Scan_text.setText(self.text_Translate("正在初始化中"))
-            self.ui.Virus_Scan_Break_Button.show()
-            QApplication.processEvents()
             for d in range(26):
                 if os.path.exists(f"{chr(65+d)}:/"):
                     self.traverse_path(f"{chr(65+d)}:/")
@@ -773,32 +754,41 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
         except Exception as e:
             self.pyas_bug_log(e)
             self.virus_scan_break()
-            self.ui.Virus_Scan_text.setText(self.text_Translate("請選擇掃描方式"))
+
+    def start_scan(self, file):
+        try:
+            if self.high_sensitivity == 0 and self.sign_scan(file):
+                if str("."+file.split(".")[-1]).lower() in slist:
+                    if self.api_scan(file):
+                        self.write_scan(self.text_Translate("惡意"),file)
+                    elif self.scr_scan(file):
+                        self.write_scan(self.text_Translate("可疑"),file)
+                    elif self.pe_scan(file):
+                        self.write_scan(self.text_Translate("可疑"),file)
+            elif self.high_sensitivity == 1:
+                if self.api_scan(file):
+                    self.write_scan(self.text_Translate("惡意"),file)
+                elif self.scr_scan(file):
+                    self.write_scan(self.text_Translate("可疑"),file)
+                elif self.pe_scan(file):
+                    self.write_scan(self.text_Translate("可疑"),file)
+        except:
+            pass
 
     def traverse_path(self,path):
         for fd in os.listdir(path):
             try:
                 file = str(os.path.join(path,fd)).replace("\\", "/")
                 if self.scan == False:
-                    break
-                elif file in self.whitelist or ":/$Recycle.Bin" in file or ":/Windows" in file:
+                    return
+                elif file in self.whitelist or ":/Windows" in file:
                     continue
                 elif os.path.isdir(file):
                     self.traverse_path(file)
                 else:
                     self.ui.Virus_Scan_text.setText(self.text_Translate(f"正在掃描: ")+file)
                     QApplication.processEvents()
-                    if self.high_sensitivity == 0 and self.sign_scan(file):
-                        if str(os.path.splitext(fd)[1]).lower() in slist:
-                            if self.api_scan(file):
-                                self.write_scan(self.text_Translate("惡意"),file)
-                            elif self.pe_scan(file):
-                                self.write_scan(self.text_Translate("可疑"),file)
-                    elif self.high_sensitivity == 1:
-                        if self.api_scan(file):
-                            self.write_scan(self.text_Translate("惡意"),file)
-                        elif self.pe_scan(file):
-                            self.write_scan(self.text_Translate("可疑"),file)
+                    self.start_scan(file)
                 gc.collect()
             except:
                 continue
@@ -816,26 +806,30 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
 
     def sign_scan(self, file):
         try:
-            pe = PE(file, fast_load=True)
-            pe.close()
-            return pe.OPTIONAL_HEADER.DATA_DIRECTORY[DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
+            with PE(file, fast_load=True) as pe:
+                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
         except:
             return True
 
-    def pe_scan(self,file):
+    def scr_scan(self, file):
+        try:
+            with open(file, "r", encoding="utf-8") as f:
+                text = f.read()
+            return any(sn in text for sn in scripts_list)
+        except:
+            return False
+
+    def pe_scan(self, file):
         try:
             fn = []
-            pe = PE(file)
-            pe.close()
-            for entry in pe.DIRECTORY_ENTRY_IMPORT:
-                for func in entry.imports:
-                    try:
-                        fn.append(str(func.name, "utf-8"))
-                    except:
-                        pass
-            if fn in function_list:
-                return True
-            return False
+            with PE(file) as pe:
+                for entry in pe.DIRECTORY_ENTRY_IMPORT:
+                    for func in entry.imports:
+                        try:
+                            fn.append(str(func.name, "utf-8"))
+                        except:
+                            pass
+            return fn in function_list
         except:
             return False
 
@@ -961,8 +955,8 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
             pass
 
     def is_process_running(self, name):
-        for proc in psutil.process_iter(['name']):
-            if proc.info['name'] == name:
+        for proc in psutil.process_iter():
+            if p.name() == name:
                 return True
         return False
 
@@ -1049,7 +1043,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
 
     def block_window_threading_init(self):
         self.block_window = True
-        Thread(target=self.block_software_window).start()
+        Thread(target=self.block_software_window, daemon=True).start()
 
     def block_software_window(self):
         while self.block_window:
@@ -1121,7 +1115,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
             self.ui.Protection_switch_Button.setStyleSheet("""
             QPushButton{border:none;background-color:rgba(20,200,20,100);border-radius: 15px;}
             QPushButton:hover{background-color:rgba(20,200,20,120);}""")
-            Thread(target=self.protect_system_processes).start()
+            Thread(target=self.protect_system_processes, daemon=True).start()
 
     def protect_threading_init_2(self):
         if self.ui.Protection_switch_Button_2.text() == self.text_Translate("已開啟"):
@@ -1136,9 +1130,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
             self.ui.Protection_switch_Button_2.setStyleSheet("""
             QPushButton{border:none;background-color:rgba(20,200,20,100);border-radius: 15px;}
             QPushButton:hover{background-color:rgba(20,200,20,120);}""")
-            for d in range(26):
-                if os.path.exists(f"{chr(65+d)}:/"):
-                    Thread(target=self.protect_system_file, args=(f"{chr(65+d)}:/",)).start()
+            Thread(target=self.protect_system_file, args=("C:/Users/",), daemon=True).start()
 
     def protect_threading_init_3(self):
         if self.ui.Protection_switch_Button_3.text() == self.text_Translate("已開啟"):
@@ -1153,7 +1145,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
             self.ui.Protection_switch_Button_3.setStyleSheet("""
             QPushButton{border:none;background-color:rgba(20,200,20,100);border-radius: 15px;}
             QPushButton:hover{background-color:rgba(20,200,20,120);}""")
-            Thread(target=self.protect_system_mbr_repair).start()
+            Thread(target=self.protect_system_mbr_repair, daemon=True).start()
 
     def protect_threading_init_4(self):
         if self.ui.Protection_switch_Button_4.text() == self.text_Translate("已開啟"):
@@ -1168,7 +1160,7 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
             self.ui.Protection_switch_Button_4.setStyleSheet("""
             QPushButton{border:none;background-color:rgba(20,200,20,100);border-radius: 15px;}
             QPushButton:hover{background-color:rgba(20,200,20,120);}""")
-            Thread(target=self.protect_system_reg_repair).start()
+            Thread(target=self.protect_system_reg_repair, daemon=True).start()
 
     def protect_threading_init_5(self):
         if self.ui.Protection_switch_Button_5.text() == self.text_Translate("已開啟"):
@@ -1183,42 +1175,40 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
             self.ui.Protection_switch_Button_5.setStyleSheet("""
             QPushButton{border:none;background-color:rgba(20,200,20,100);border-radius: 15px;}
             QPushButton:hover{background-color:rgba(20,200,20,120);}""")
-            Thread(target=self.protect_system_enhanced).start()
+            Thread(target=self.protect_system_enhanced, daemon=True).start()
 
     def protect_system_processes(self):
-        existing_proc = {}
-        for proc in psutil.process_iter(['name', 'exe']):
-            existing_proc[str(proc.info['name'])] = str(proc.info['exe']).replace("\\", "/")
-        while self.proc_protect:
-            try:
-                time.sleep(0.2)
-                current_proc = {}
-                for proc in psutil.process_iter(['name', 'exe']):
-                    current_proc[str(proc.info['name'])] = str(proc.info['exe']).replace("\\", "/")
-                new_proc = {name: path for name, path in current_proc.items() if name not in existing_proc}
-                if new_proc:
-                    for self.p_name, self.p_file in new_proc.items():
-                        if self.p_file == self.pyas or self.p_file in self.whitelist:
+        existing_processes = set()
+        for p in psutil.process_iter():
+            if p.pid not in existing_processes:
+                existing_processes.add(p.pid)
+        while True:
+            time.sleep(0.1)
+            for p in psutil.process_iter():
+                try:
+                    if p.pid not in existing_processes:
+                        existing_processes.add(p.pid)
+                        name, file = p.name(), p.exe().replace("\\", "/")
+                        if ':/Windows' in file or ':/Program' in file:
                             continue
-                        elif ":/Windows" in self.p_file or ":/Program" in self.p_file:
+                        elif file == self.pyas or file in self.whitelist:
                             continue
-                        elif self.api_scan(self.p_file):
-                            if self.protect_process_kill(self.p_name):
-                                self.system_notification(self.text_Translate("惡意軟體攔截: ")+self.p_name)
-                        elif self.pe_scan(self.p_file):
-                            if self.protect_process_kill(self.p_name):
-                                self.system_notification(self.text_Translate("可疑檔案攔截: ")+self.p_name)
-                        elif self.sign_scan(self.p_file):
-                            self.p_check = self.p_name
+                        elif self.api_scan(file):
+                            p.kill()
+                            self.system_notification(self.text_Translate("惡意軟體攔截: ")+name)
+                        elif self.pe_scan(file):
+                            p.kill()
+                            self.system_notification(self.text_Translate("可疑軟體攔截: ")+name)
+                        elif self.sign_scan(file):
+                            self.p_check = name
                         gc.collect()
-                existing_proc = current_proc
-            except:
-                pass
+                except:
+                    pass
 
     def protect_process_kill(self,proc):
         try:
-            for p in psutil.process_iter(['name', 'exe']):
-                if p.info['name'] == proc:
+            for p in psutil.process_iter():
+                if p.name() == proc:
                     p.kill()
                     return True
             return False
@@ -1227,24 +1217,20 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
 
     def protect_system_file(self,path):
         hDir = win32file.CreateFile(path,win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-        self.last_file = ""
         while self.file_protect:
             try:
                 for action, file in win32file.ReadDirectoryChangesW(hDir,1024,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
                     file = str(f"{path}{file}").replace("\\", "/")
-                    file_type = str(os.path.splitext(file)[1]).lower()
-                    file_name = str(os.path.splitext(file)[0])
+                    file_type_end = str("."+file.split(".")[-1]).lower()
+                    file_type_mid = str("."+file.split(".")[-2]).lower()
                     if file == self.pyas or file in self.whitelist:
                         continue
-                    elif ":/Windows" in file or ":/Program" in file or "/AppData/" in file:
-                        continue
-                    elif action:
-                        if file_type in slist and self.sign_scan(file) and self.api_scan(file):
+                    elif action == 1 or action == 3:
+                        if file_type_mid in alist and self.protect_process_kill(self.p_check):
+                            self.system_notification(self.text_Translate("勒索軟體攔截: ")+self.p_check)
+                        elif file_type_end in slist and self.sign_scan(file) and self.api_scan(file):
                             os.remove(file)
                             self.system_notification(self.text_Translate("惡意軟體刪除: ")+file)
-                        elif self.last_file == file_name and self.protect_process_kill(self.p_check):
-                            self.system_notification(self.text_Translate("勒索軟體攔截: ")+self.p_check)
-                        self.last_file = file_name
                     gc.collect()
             except:
                 pass
@@ -1257,6 +1243,8 @@ class MainWindow_Controller(QtWidgets.QMainWindow):
                     if f.read(512) != self.mbr_value:
                         f.seek(0)
                         f.write(self.mbr_value)
+                        if self.protect_process_kill(self.p_check):
+                            self.system_notification(self.text_Translate("惡意行為攔截: ")+self.p_check)
             except:
                 pass
 

PYAS_Extension.py

@@ -1,10 +1,9 @@
 slist = [".exe",".dll",".com",".msi",".scr",
-         ".bat",".cmd",".ps1",".vbs",".js",
-         ".jar",".htm",".html",".ppt",".pptx",
-         ".pdf",".xls",".xlsx",".doc",".docx"]
+         ".bat",".cmd",".ps1",".vbs",".js"]
 
 alist = [".exe",".dll",".ppt",".pptx",".wps",
          ".pdf",".xls",".xlsx",".doc",".docx",
          ".jpg",".jpeg",".png",".webp",".gif",
          ".mp3",".wav",".aac",".ogg",".flac",
-         ".mp4",".avi",".mov",".wmv",".mkv"]
+         ".mp4",".avi",".mov",".wmv",".mkv",
+         ".zip",".gz",".7z",".rar",".tar"]

PYAS_Function.py

@@ -1 +1 @@
-function_list = [['LoadLibraryA', 'GetProcAddress', 'SetUnhandledExceptionFilter', 'GetCurrentProcess', 'TerminateProcess', 'IsProcessorFeaturePresent', 'QueryPerformanceCounter', 'GetCurrentProcessId', 'GetCurrentThreadId', 'GetSystemTimeAsFileTime', 'InitializeSListHead', 'IsDebuggerPresent', 'GetModuleHandleW', 'UnhandledExceptionFilter', 'GetDC', '?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ', '?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z', '?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ', '?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z', '??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ', '?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ', '?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z', '?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ', '?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ', '?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z', '?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z', '?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ', '?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z', '??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ', '??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z', '?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z', '?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z', '?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z', '?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ', '?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z', '?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z', '?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z', '?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ', '??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ', '?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ', '?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z', '?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z', '??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ', '??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z', '??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ', '?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z', '?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z', '?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ', '?width@ios_base@std@@QAE_J_J@Z', '?width@ios_base@std@@QBE_JXZ', '?flags@ios_base@std@@QBEHXZ', '?good@ios_base@std@@QBE_NXZ', '?always_noconv@codecvt_base@std@@QBE_NXZ', '??Bid@locale@std@@QAEIXZ', '?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z', '??1_Lockit@std@@QAE@XZ', '??0_Lockit@std@@QAE@H@Z', '?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A', '?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ', '?uncaught_exception@std@@YA_NXZ', '?_Xout_of_range@std@@YAXPBD@Z', '?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A', '?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z', '?_Xlength_error@std@@YAXPBD@Z', '?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ', '_CxxThrowException', '__current_exception_context', '__std_exception_copy', '__std_exception_destroy', '__CxxFrameHandler3', 'memcpy', '__current_exception', 'memset', '_except_handler4_common', 'memmove', '_fseeki64', '__p__commode', 'fsetpos', 'ungetc', 'setvbuf', 'fgetpos', 'fwrite', '_set_fmode', '_get_stream_buffer_pointers', '__stdio_common_vfprintf', 'fgetc', 'fclose', 'fflush', '__acrt_iob_func', 'fputc', 'fread', '_lock_file', '_unlock_file', 'exit', '_exit', '_configure_narrow_argv', '__p___argc', '_initterm_e', '_cexit', '_c_exit', '_register_thread_local_exe_atexit_callback', '_initterm', '_set_app_type', '_get_initial_narrow_environment', '_seh_filter_exe', '_initialize_onexit_table', '_register_onexit_function', '_crt_atexit', '_controlfp_s', 'terminate', '_initialize_narrow_environment', '_invalid_parameter_noinfo_noreturn', '__p___argv', 'free', '_set_new_mode', 'malloc', '_callnewh', '__setusermatherr', '_configthreadlocale'], ['GetCurrentProcess', 'FindNextFileA', 'FindClose', 'GetSystemDirectoryA', 'DeleteFileA', 'SetFileAttributesA', 'ExitProcess', 'FLine truncated
+function_list = [['LoadLibraryA', 'GetProcAddress', 'SetUnhandledExceptionFilter', 'GetCurrentProcess', 'TerminateProcess', 'IsProcessorFeaturePresent', 'QueryPerformanceCounter', 'GetCurrentProcessId', 'GetCurrentThreadId', 'GetSystemTimeAsFileTime', 'InitializeSListHead', 'IsDebuggerPresent', 'GetModuleHandleW', 'UnhandledExceptionFilter', 'GetDC', '?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ', '?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z', '?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ', '?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z', '??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ', '?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ', '?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z', '?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ', '?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ', '?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z', '?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z', '?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ', '?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z', '??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ', '??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z', '?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z', '?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z', '?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z', '?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ', '?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ', '?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z', '?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ', '?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z', '?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z', '?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ', '??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ', '?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ', '?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z', '?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z', '??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ', '??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z', '??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ', '?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z', '?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z', '?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ', '?width@ios_base@std@@QAE_J_J@Z', '?width@ios_base@std@@QBE_JXZ', '?flags@ios_base@std@@QBEHXZ', '?good@ios_base@std@@QBE_NXZ', '?always_noconv@codecvt_base@std@@QBE_NXZ', '??Bid@locale@std@@QAEIXZ', '?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z', '??1_Lockit@std@@QAE@XZ', '??0_Lockit@std@@QAE@H@Z', '?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A', '?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ', '?uncaught_exception@std@@YA_NXZ', '?_Xout_of_range@std@@YAXPBD@Z', '?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A', '?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z', '?_Xlength_error@std@@YAXPBD@Z', '?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ', '_CxxThrowException', '__current_exception_context', '__std_exception_copy', '__std_exception_destroy', '__CxxFrameHandler3', 'memcpy', '__current_exception', 'memset', '_except_handler4_common', 'memmove', '_fseeki64', '__p__commode', 'fsetpos', 'ungetc', 'setvbuf', 'fgetpos', 'fwrite', '_set_fmode', '_get_stream_buffer_pointers', '__stdio_common_vfprintf', 'fgetc', 'fclose', 'fflush', '__acrt_iob_func', 'fputc', 'fread', '_lock_file', '_unlock_file', 'exit', '_exit', '_configure_narrow_argv', '__p___argc', '_initterm_e', '_cexit', '_c_exit', '_register_thread_local_exe_atexit_callback', '_initterm', '_set_app_type', '_get_initial_narrow_environment', '_seh_filter_exe', '_initialize_onexit_table', '_register_onexit_function', '_crt_atexit', '_controlfp_s', 'terminate', '_initialize_narrow_environment', '_invalid_parameter_noinfo_noreturn', '__p___argv', 'free', '_set_new_mode', 'malloc', '_callnewh', '__setusermatherr', '_configthreadlocale'], ['GetCurrentProcess', 'FindNextFileA', 'FindClose', 'GetSystemDirectoryA', 'DeleteFileA', 'SetFileAttributesA', 'ExitProcess', 'FLine truncated

PYAS_Language.py

@@ -13,10 +13,10 @@ translations = {"zh_TW": {"已开启":"已開啟","已关闭":"已關閉","On":"
                           "類":"类","輸":"输","執":"执","數":"数","尋":"寻","網":"网","詢":"询",
                           "製":"制","員":"员","許":"许","條":"条","藍":"蓝","紅":"红","綠":"绿",
                           "態":"态","務":"务","連":"连","檢":"检","測":"测","關":"关","強":"强",
-                          "驅":"驱",},
+                          "驅":"驱","為":"为",},
                 "en_US": {"已開啟":"On","已關閉":"Off","已开启":"On","已关闭":"Off","，":", ",
                           "立即刪除":"Delete Now","安全模式":"Safe Mode","官方網站":"Website",
-                          "可疑檔案":"Suspicious ","惡意軟體":"Malware ","勒索軟體":"Ransom ",
+                          "可疑軟體":"Suspicious ","惡意軟體":"Malware ","勒索軟體":"Ransom ",
                           "許可條款":"License Terms","惡意":"Malicious","可疑":"Suspicious",
                           "啟用":"Enable ","禁用":"Disable ","正在初始化中":"Initializing ",
                           "正在掃描":"Scanning ","正在刪除":"Deleting ","最小化到":"Minimize To ",
@@ -47,4 +47,4 @@ translations = {"zh_TW": {"已开启":"已開啟","已关闭":"已關閉","On":"
                           "高":"High ","新":"New ","和":"And ","會":"Can ","密鑰":"Key ",
                           "日誌":"Log","已":"Has ","彈窗":"Window ","要":"To ","驅動":"Drive ",
                           "的":"","顯示":"","個":"","嗎":"","中":"","了":"","行":"","稱":"",
-                          "檢測":"Detect ","立即":"","  ":" "}}
+                          "檢測":"Detect ","惡意行為":"Behavior ","立即":"","  ":" "}}

PYAS_Scripts.py

@@ -0,0 +1 @@
+scripts_list = ["%0|%0","ExclusionPath","cmdkey","eiculwo"]

PYAS_Version.py

@@ -1,7 +1,7 @@
 import pyinstaller_versionfile
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='2.7.9',
+version='2.8.1',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -1,5 +1,5 @@
 # PYAS (Python Antivirus Software)
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/e49a0aef-6ef6-4485-8f93-e7a73f9571ea)
+![PYAS](https://github.com/87owo/PYAS/assets/85057800/46f46cf0-dbf3-4a33-b28d-234f610f1a07)
 
 ## Official Website
 https://pyantivirus.wixsite.com/pyas , 
@@ -12,9 +12,9 @@ https://github.com/87owo/PYAS/blob/main/LICENSE.md
 Windows 8.1, 10, 11 (64-bit), Ram 1GB, Rom 1GB or higher
 
 ## Import Module
-os, sys, time, json, psutil, ctypes, requests, subprocess, win32file, win32api, win32con, elementpath, hashlib, pefile, threading, PyQt5, PYAS_Language, PYAS_Model, PYAS_UI
+os, gc, sys, time, json, requests, psutil, ctypes, pywin32, subprocess, xml, hashlib, pefile, PyQt5, threading, PYAS_Language, PYAS_Scripts, PYAS_Function, PYAS_Extension, PYAS_Interface
 
 ## Special Thanks
-360, Wix, VirusShare, mtkiao129, LenStevens, 0607zzy
+360, Wix, VirusShare, mtkiao129, LenStevens
 
 Copyright© 2020~2023 PYAS Security By 87owo