Add files via upload

PYAS.py

@@ -4,7 +4,6 @@ import requests, pyperclip, win32file
 import win32gui, win32api, win32con
 import xml.etree.ElementTree as xmlet
 from PYAS_Function import function_list
-from PYAS_Function_Safe import function_list_safe
 from PYAS_Extension import slist, alist
 from PYAS_Language import translate_dict
 from PYAS_Interface import Ui_MainWindow
@@ -19,7 +18,7 @@ class MainWindow_Controller(QMainWindow):
         self.setAttribute(Qt.WA_TranslucentBackground)
         self.setWindowFlags(Qt.FramelessWindowHint)
         self.pyas = str(sys.argv[0]).replace("\\", "/")
-        self.pyas_version = "2.9.3"
+        self.pyas_version = "2.9.4"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
         self.init_tray_icon()
@@ -532,8 +531,9 @@ class MainWindow_Controller(QMainWindow):
         self.timer.start(2)
 
     def showMinimized(self):
-        self.hide_pyas_ui()
-        self.send_notify(self.trans("PYAS 已最小化到系統托盤圖標"))
+        if self.block_window:
+            self.hide_pyas_ui()
+            self.send_notify(self.trans("PYAS 已最小化到系統托盤圖標"))
 
     def closeEvent(self, event):
         if QMessageBox.warning(self,self.trans("警告"),self.trans("您確定要退出 PYAS 和所有防護嗎?"),QMessageBox.Yes|QMessageBox.No) == 16384:
@@ -835,20 +835,13 @@ class MainWindow_Controller(QMainWindow):
                             fn.append(str(func.name, "utf-8"))
                         except:
                             pass
-            max_vfl = []
             for vfl in function_list:
                 QApplication.processEvents()
-                max_vfl.append(len(set(fn)&set(vfl))/len(set(fn)|set(vfl)))
-            max_sfl = []
-            for sfl in function_list_safe:
-                QApplication.processEvents()
-                max_sfl.append(len(set(fn)&set(sfl))/len(set(fn)|set(sfl)))
-            if self.high_sensitivity and max(max_vfl) == 1.0:
-                print(f'Engine: PYAS ML Engine\nDetect: Virus\nLevels: {max(max_vfl)}/{max(max_sfl)}\nFile: {file}\n{"="*50}')
-                return True
-            elif max(max_vfl) - max(max_sfl) >= 0.1:
-                print(f'Engine: PYAS ML Engine\nDetect: Suspicious\nLevels: {max(max_vfl)}/{max(max_sfl)}\nFile: {file}\n{"="*50}')
-                return True
+                similarity = len(set(fn)&set(vfl))/len(set(fn)|set(vfl))
+                if self.high_sensitivity and similarity >= 0.9:
+                    return True
+                elif "_CorExeMain" not in fn and similarity == 1.0:
+                    return True
             return False
         except:
             return False
@@ -1187,17 +1180,18 @@ class MainWindow_Controller(QMainWindow):
                     if p.pid not in existing_processes and file not in self.whitelist:
                         existing_processes.add(p.pid)
                         psutil.Process(p.pid).suspend()
+                        if ":/Windows" in file and "powershell" in name:
+                            file = str(cmd[-1].split("'")[-2]).replace("\\", "/")
+                        elif ":/Windows" in file and "cmd.exe" in name:
+                            file = str(" ".join(cmd[2:])).replace("\\", "/")
+                        elif ":/Windows" in file and "msiexec.exe" in name:
+                            file = str(cmd[-1]).replace("\\", "/")
+                        elif ":/Windows" in file and "cscript.exe" in name:
+                            file = str(cmd[-1]).replace("\\", "/")
+                        elif ":/Windows" in file and "wscript.exe" in name:
+                            file = str(cmd[-1]).replace("\\", "/")
                         if ":/Windows" in file or ":/Program" in file:
-                            if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
-                                p.kill()
-                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
-                            elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
-                                p.kill()
-                                self.send_notify(self.trans("惡意腳本攔截: ")+file)
-                            elif ":/Windows" in file and self.api_scan(cmd[-1]):
-                                p.kill()
-                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif self.sign_scan(file) and self.api_scan(file):
+                            if self.sign_scan(file) and self.api_scan(file):
                                 p.kill()
                                 self.send_notify(self.trans("惡意軟體攔截: ")+file)
                         elif self.api_scan(file) or self.pe_scan(file):

PYAS_Version.py

@@ -1,7 +1,7 @@
 import pyinstaller_versionfile
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='2.9.3',
+version='2.9.4',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",