Add files via upload

PYAS.py

@@ -4,6 +4,7 @@ import requests, pyperclip, win32file
 import win32gui, win32api, win32con
 import xml.etree.ElementTree as xmlet
 from PYAS_Function import function_list
+from PYAS_Function_Safe import function_list_safe
 from PYAS_Extension import slist, alist
 from PYAS_Language import translate_dict
 from PYAS_Interface import Ui_MainWindow
@@ -18,7 +19,7 @@ class MainWindow_Controller(QMainWindow):
         self.setAttribute(Qt.WA_TranslucentBackground)
         self.setWindowFlags(Qt.FramelessWindowHint)
         self.pyas = str(sys.argv[0]).replace("\\", "/")
-        self.pyas_version = "2.9.1"
+        self.pyas_version = "2.9.3"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
         self.init_tray_icon()
@@ -268,7 +269,7 @@ class MainWindow_Controller(QMainWindow):
         self.ui.Window_Block_Button.setText(self.trans("軟體彈窗攔截"))
         self.ui.Repair_System_Network_Button.setText(self.trans("系統網路修復"))
         self.ui.About_Back.setText(self.trans("返回"))
-        self.ui.PYAS_Version.setText(self.trans(f"PYAS V{self.pyas_version}"))
+        self.ui.PYAS_Version.setText(self.trans(f"PYAS V{self.pyas_version} (ML Engine)"))
         self.ui.GUI_Made_title.setText(self.trans("介面製作:"))
         self.ui.GUI_Made_Name.setText(self.trans("mtkiao"))
         self.ui.Core_Made_title.setText(self.trans("核心製作:"))
@@ -838,8 +839,17 @@ class MainWindow_Controller(QMainWindow):
             for vfl in function_list:
                 QApplication.processEvents()
                 max_vfl.append(len(set(fn)&set(vfl))/len(set(fn)|set(vfl)))
-            print(f'Virus:{int(max(max_vfl)*100)}%')
-            return max(max_vfl) > 0.9
+            max_sfl = []
+            for sfl in function_list_safe:
+                QApplication.processEvents()
+                max_sfl.append(len(set(fn)&set(sfl))/len(set(fn)|set(sfl)))
+            if self.high_sensitivity and max(max_vfl) == 1.0:
+                print(f'Engine: PYAS ML Engine\nDetect: Virus\nLevels: {max(max_vfl)}/{max(max_sfl)}\nFile: {file}\n{"="*50}')
+                return True
+            elif max(max_vfl) - max(max_sfl) >= 0.1:
+                print(f'Engine: PYAS ML Engine\nDetect: Suspicious\nLevels: {max(max_vfl)}/{max(max_sfl)}\nFile: {file}\n{"="*50}')
+                return True
+            return False
         except:
             return False
 
@@ -944,6 +954,8 @@ class MainWindow_Controller(QMainWindow):
                 for i in Permission:
                     try:
                         win32api.RegDeleteValue(key,i)
+                        self.proc.kill()
+                        self.send_notify(self.trans("惡意行為攔截: ")+self.proc.name().replace("\\", "/"))
                     except:
                         pass
                 win32api.RegCloseKey(key)
@@ -1171,26 +1183,28 @@ class MainWindow_Controller(QMainWindow):
             time.sleep(0.05)
             for p in psutil.process_iter():
                 try:
-                    if p.pid not in existing_processes:
+                    name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
+                    if p.pid not in existing_processes and file not in self.whitelist:
                         existing_processes.add(p.pid)
                         psutil.Process(p.pid).suspend()
-                        name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-                        if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
+                        if ":/Windows" in file or ":/Program" in file:
+                            if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
+                                p.kill()
+                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
+                            elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
+                                p.kill()
+                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
+                            elif ":/Windows" in file and self.api_scan(cmd[-1]):
+                                p.kill()
+                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
+                            elif self.sign_scan(file) and self.api_scan(file):
+                                p.kill()
+                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
+                        elif self.api_scan(file) or self.pe_scan(file):
                             p.kill()
-                            self.send_notify(self.trans("惡意腳本攔截: ")+name)
-                        elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
-                            p.kill()
-                            self.send_notify(self.trans("惡意腳本攔截: ")+name)
-                        elif ":/Windows" in file and self.api_scan(cmd[-1]):
-                            p.kill()
-                            self.send_notify(self.trans("惡意軟體攔截: ")+name)
-                        elif ":/Windows" not in file and ":/Program" not in file:
-                            if file != self.pyas and file not in self.whitelist:
-                                if self.api_scan(file) or self.pe_scan(file):
-                                    p.kill()
-                                    self.send_notify(self.trans("惡意軟體攔截: ")+name)
-                                elif self.sign_scan(file):
-                                    self.proc = p
+                            self.send_notify(self.trans("惡意軟體攔截: ")+file)
+                        elif file != self.pyas and self.sign_scan(file):
+                            self.proc = p
                         psutil.Process(p.pid).resume()
                         gc.collect()
                 except:
@@ -1200,13 +1214,15 @@ class MainWindow_Controller(QMainWindow):
         hDir = win32file.CreateFile("C:/Users/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
         self.ransom_block = False
         while self.file_protect:
-            for action, file in win32file.ReadDirectoryChangesW(hDir,1024,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
+            for action, file in win32file.ReadDirectoryChangesW(hDir,1048576,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
                 try:
-                    if action == 2 and str(f".{file.split('.')[-1]}").lower() in alist:
-                        if self.ransom_block and "AppData" not in file:
+                    full_path = str(f"C:/Users/{file}").replace("\\", "/")
+                    file_type = str(f".{full_path.split('.')[-1]}").lower()
+                    if action == 2 and "/AppData/" not in full_path and file_type in alist:
+                        if self.ransom_block:
                             self.proc.kill()
                             self.ransom_block = False
-                            self.send_notify(self.trans("勒索軟體攔截: ")+self.proc.name())
+                            self.send_notify(self.trans("勒索軟體攔截: ")+self.proc.exe().replace("\\", "/"))
                         self.ransom_block = True
                 except:
                     pass
@@ -1218,12 +1234,12 @@ class MainWindow_Controller(QMainWindow):
                 with open(r"\\.\PhysicalDrive0", "r+b") as f:
                     if self.mbr_value[510:512] != b'\x55\xAA':
                         self.proc.kill()
-                        self.send_notify(self.trans("惡意行為攔截: ")+self.proc.name())
+                        self.send_notify(self.trans("惡意行為攔截: ")+self.proc.exe().replace("\\", "/"))
                     elif f.read(512) != self.mbr_value:
                         f.seek(0)
                         f.write(self.mbr_value)
                         self.proc.kill()
-                        self.send_notify(self.trans("惡意行為攔截: ")+self.proc.name())
+                        self.send_notify(self.trans("惡意行為攔截: ")+self.proc.exe().replace("\\", "/"))
             except:
                 pass
 
@@ -1245,7 +1261,7 @@ class MainWindow_Controller(QMainWindow):
                 for conn in self.proc.connections():
                     if socket.gethostbyname(socket.gethostname()) == conn.laddr.ip:
                         self.proc.kill()
-                        self.send_notify(self.trans("網路通訊攔截: ")+self.proc.name())
+                        self.send_notify(self.trans("網路通訊攔截: ")+self.proc.exe().replace("\\", "/"))
             except:
                 pass
 

PYAS_Version.py

@@ -1,7 +1,7 @@
 import pyinstaller_versionfile
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='2.9.1',
+version='2.9.3',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -14,9 +14,9 @@ Windows 8.1, 10, 11 (64-bit), Ram 1GB, Rom 1GB or higher
 psutil==5.9.5, pefile==2023.2.7, requests==2.31.0, pyperclip==1.8.2, pywin32==306, PyQt5==5.15.9
 
 ## Import Module
-os, gc, sys, time, json, psutil, hashlib, pefile, socket, msvcrt, requests, pyperclip, win32file, win32gui, win32api, win32con, xml, PYAS_Scripts, PYAS_Function, PYAS_Extension, PYAS_Language, PYAS_Interface, threading, PyQt5
+os, gc, sys, time, json, psutil, hashlib, pefile, socket, msvcrt, requests, pyperclip, win32file, win32gui, win32api, win32con, xml, PYAS_Function, PYAS_Function_Safe, PYAS_Extension, PYAS_Language, PYAS_Interface, threading, PyQt5
 
 ## Special Thanks
-360, Wix, VirusShare, mtkiao129, LenStevens
+360, Wix, VirusShare, mtkiao129, LenStevens, AV-T Team of LisectGroup
 
 Copyright© 2020~2023 PYAS Security By 87owo