Add files via upload

PYAS.py

@@ -1,11 +1,11 @@
 import os, gc, sys, time, json, psutil
 import hashlib, pefile, socket, msvcrt
+import xml.etree.ElementTree as xmlet
 import requests, pyperclip, win32file
 import win32gui, win32api, win32con
-import xml.etree.ElementTree as xmlet
-from PYAS_Function import function_list
-from PYAS_Function_Safe import function_list_safe
 from PYAS_Extension import slist, alist
+from PYAS_Function_Safe import func_safe
+from PYAS_Function_Virus import func_virus
 from PYAS_Language import translate_dict
 from PYAS_Interface import Ui_MainWindow
 from threading import Thread
@@ -19,7 +19,7 @@ class MainWindow_Controller(QMainWindow):
         self.setAttribute(Qt.WA_TranslucentBackground)
         self.setWindowFlags(Qt.FramelessWindowHint)
         self.pyas = str(sys.argv[0]).replace("\\", "/")
-        self.pyas_version = "2.9.6"
+        self.pyas_version = "2.9.8"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
         self.init_tray_icon()
@@ -550,11 +550,11 @@ class MainWindow_Controller(QMainWindow):
         except:
             pass
 
-    def send_notify(self,text):
+    def send_notify(self, text):
         try:
             now_time = time.strftime('%Y/%m/%d %H:%M:%S')
-            self.ui.State_output.append(f"[{now_time}] {text}")
             self.tray_icon.showMessage(now_time, text, 5000)
+            QMetaObject.invokeMethod(self.ui.State_output, "append", Qt.QueuedConnection, Q_ARG(str, f"[{now_time}] {text}"))
         except:
             pass
 
@@ -781,7 +781,7 @@ class MainWindow_Controller(QMainWindow):
                     self.write_scan(self.trans("惡意"),file)
                 elif self.pe_scan(file):
                     self.write_scan(self.trans("可疑"),file)
-            elif file_type in slist and self.sign_scan(file):
+            elif file_type in slist and file != self.pyas:
                 if self.api_scan(file):
                     self.write_scan(self.trans("惡意"),file)
                 elif self.pe_scan(file):
@@ -812,6 +812,7 @@ class MainWindow_Controller(QMainWindow):
             if self.cloud_services == 1:
                 with open(file, "rb") as f:
                     text = str(hashlib.md5(f.read()).hexdigest())
+                QApplication.processEvents()
                 strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
                 response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3)
                 return response.status_code == 200 and float(xmlet.fromstring(response.text).find('.//e_level').text) > 50
@@ -837,17 +838,26 @@ class MainWindow_Controller(QMainWindow):
                         except:
                             pass
             max_vfl = []
-            for vfl in function_list:
+            for vfl in func_virus:
                 QApplication.processEvents()
                 max_vfl.append(len(set(fn)&set(vfl))/len(set(fn)|set(vfl)))
             max_sfl = []
-            for sfl in function_list_safe:
+            for sfl in func_safe:
                 QApplication.processEvents()
                 max_sfl.append(len(set(fn)&set(sfl))/len(set(fn)|set(sfl)))
-            if self.high_sensitivity and max(max_vfl) == 1.0:
-                return True
-            elif max(max_vfl) - max(max_sfl) >= 0.1:
-                return True
+            if self.high_sensitivity:
+                return max(max_vfl) >= max(max_sfl)
+            return max(max_vfl) - max(max_sfl) >= 0.1
+        except:
+            return False
+
+    def proc_scan(self, pid):
+        try:
+            for entry in psutil.Process(pid).memory_maps():
+                file = entry.path.replace("\\", "/")
+                if ":/Windows" not in file and ":/Program" not in file:
+                    if self.api_scan(file) or self.pe_scan(file):
+                        return True
             return False
         except:
             return False
@@ -1182,49 +1192,41 @@ class MainWindow_Controller(QMainWindow):
             time.sleep(0.05)
             for p in psutil.process_iter():
                 try:
-                    name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-                    if p.pid not in existing_processes and file not in self.whitelist:
+                    if p.pid not in existing_processes:
                         existing_processes.add(p.pid)
-                        psutil.Process(p.pid).suspend()
-                        if ":/Windows" in file or ":/Program" in file:
+                        name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
+                        if file != self.pyas and file not in self.whitelist:
+                            psutil.Process(p.pid).suspend()
                             if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
                                 p.kill()
                                 self.send_notify(self.trans("惡意腳本攔截: ")+str(cmd[-1].split("'")[-2]))
                             elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
                                 p.kill()
                                 self.send_notify(self.trans("惡意腳本攔截: ")+str(" ".join(cmd[2:])))
-                            elif self.sign_scan(cmd[-1]) and self.api_scan(cmd[-1]):
+                            elif ":/Windows" in file and self.api_scan(cmd[-1]):
                                 p.kill()
                                 self.send_notify(self.trans("惡意軟體攔截: ")+str(cmd[-1]))
-                        elif self.api_scan(file) or self.pe_scan(file):
-                            p.kill()
-                            self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                        elif file != self.pyas and self.sign_scan(file):
-                            self.proc = p
-                        psutil.Process(p.pid).resume()
-                        gc.collect()
+                            elif self.proc_scan(p.pid):
+                                p.kill()
+                                self.send_notify(self.trans("惡意軟體攔截: ")+file)
+                            elif self.sign_scan(file):
+                                self.proc = p
+                            psutil.Process(p.pid).resume()
+                            gc.collect()
                 except:
                     pass
 
     def protect_file_thread(self):
         hDir = win32file.CreateFile("C:/Users/",win32con.GENERIC_READ,win32con.FILE_SHARE_READ|win32con.FILE_SHARE_WRITE|win32con.FILE_SHARE_DELETE,None,win32con.OPEN_EXISTING,win32con.FILE_FLAG_BACKUP_SEMANTICS,None)
-        self.ransom_block = False
         while self.file_protect:
             for action, file in win32file.ReadDirectoryChangesW(hDir,1048576,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
                 try:
                     full_path = str(f"C:/Users/{file}").replace("\\", "/")
                     file_type = str(f".{full_path.split('.')[-1]}").lower()
-                    if action == 2 and "/AppData/" not in full_path and file_type in alist:
-                        if self.ransom_block:
-                            self.proc.kill()
-                            self.ransom_block = False
-                            self.send_notify(self.trans("勒索軟體攔截: ")+self.proc.exe().replace("\\", "/"))
-                        self.ransom_block = True
-                    #elif action == 3 and "/AppData/" not in full_path and file_type in slist:
-                        #if os.path.getsize(full_path) <= 20971520:
-                            #if self.sign_scan(full_path) and self.api_scan(full_path):
-                                #self.lock_file(full_path)
-                                #self.send_notify(self.trans("惡意軟體攔截: ")+full_path)
+                    if action == 3 and file_type in slist and os.path.getsize(full_path) <= 20971520:
+                        if os.path.isfile(full_path) and self.api_scan(full_path):
+                            os.remove(full_path)
+                            self.send_notify(self.trans("惡意軟體刪除: ")+full_path)
                 except:
                     pass
 
@@ -1259,8 +1261,9 @@ class MainWindow_Controller(QMainWindow):
         while self.net_protect:
             try:
                 time.sleep(0.5)
+                local = socket.gethostbyname(socket.gethostname())
                 for conn in self.proc.connections():
-                    if socket.gethostbyname(socket.gethostname()) == conn.laddr.ip:
+                    if conn.laddr.ip == local:
                         self.proc.kill()
                         self.send_notify(self.trans("網路通訊攔截: ")+self.proc.exe().replace("\\", "/"))
             except:

PYAS_Version.py

@@ -1,7 +1,7 @@
 import pyinstaller_versionfile
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='2.9.6',
+version='2.9.8',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",