Add files via upload

PYAS.py

@@ -20,7 +20,7 @@ class MainWindow_Controller(QMainWindow):
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
         self.pyae_version = "SimHash Engine"
-        self.pyas_version = "3.0.6"
+        self.pyas_version = "3.0.8"
         self.ui = Ui_MainWindow()
         self.ui.setupUi(self)
         self.init_show_pyas()
@@ -747,14 +747,15 @@ class MainWindow_Controller(QMainWindow):
 
     def write_scan(self, state, file):
         try:
-            self.lock_file(file, True)
-            self.virus_list.append(file)
-            self.virus_list_ui.append(f"[{state}] {file}")
-            item = QListWidgetItem()
-            item.setText(f"[{state}] {file}")
-            item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
-            item.setCheckState(Qt.Checked)
-            self.ui.Virus_Scan_output.addItem(item)
+            if state and file:
+                self.lock_file(file, True)
+                self.virus_list.append(file)
+                self.virus_list_ui.append(f"[{state}] {file}")
+                item = QListWidgetItem()
+                item.setText(f"[{state}] {file}")
+                item.setFlags(item.flags() | Qt.ItemIsUserCheckable)
+                item.setCheckState(Qt.Checked)
+                self.ui.Virus_Scan_output.addItem(item)
         except:
             pass
 
@@ -792,7 +793,7 @@ class MainWindow_Controller(QMainWindow):
             file = str(QFileDialog.getOpenFileName(self,self.trans("病毒掃描"),"C:/")[0])
             if file and file not in self.whitelist:
                 self.init_scan()
-                self.start_scan(file)
+                self.write_scan(self.start_scan(file),file)
                 self.answer_scan()
         except Exception as e:
             self.bug_event(e)
@@ -820,22 +821,6 @@ class MainWindow_Controller(QMainWindow):
             self.bug_event(e)
             self.virus_scan_break()
 
-    def start_scan(self, file):
-        try:
-            file_type = str(f".{file.split('.')[-1]}").lower()
-            if self.json["high_sensitive"] and file != self.pyas:
-                if self.api_scan(file):
-                    self.write_scan(self.trans("惡意"),file)
-                elif self.pe_scan(file):
-                    self.write_scan(self.trans("可疑"),file)
-            elif file_type in slist and file != self.pyas:
-                if self.api_scan(file):
-                    self.write_scan(self.trans("惡意"),file)
-                elif self.pe_scan(file):
-                    self.write_scan(self.trans("可疑"),file)
-        except:
-            pass
-
     def traverse_path(self,path):
         for fd in os.listdir(path):
             try:
@@ -847,29 +832,48 @@ class MainWindow_Controller(QMainWindow):
                 elif file not in self.whitelist:
                     self.ui.Virus_Scan_text.setText(self.trans(f"正在掃描: ")+file)
                     QApplication.processEvents()
-                    self.start_scan(file)
+                    self.write_scan(self.start_scan(file),file)
                 gc.collect()
             except:
                 pass
 
+    def start_scan(self, file):
+        try:
+            label, level = self.api_scan(file)
+            if file != self.pyas and level > 50:
+                return f"{label}"#.{level}"
+            elif file != self.pyas and level > 10:
+                label_2, level_2 = self.pe_scan(file)
+                if "White" not in label_2 and "Unknown" not in label_2:
+                    return f"{label_2}"#.{int(level_2*100)}"
+                elif "Unknown" in label_2 and self.json["high_sensitive"]:
+                    return f"{label_2}"#.{int(level_2*100)}"
+            elif file != self.pyas and not level:
+                label_2, level_2 = self.pe_scan(file)
+                if "White" not in label_2 and "Unknown" not in label_2:
+                    return f"{label_2}"#.{int(level_2*100)}"
+                elif "Unknown" in label_2 and self.json["high_sensitive"]:
+                    return f"{label_2}"#.{int(level_2*100)}"
+            return False
+        except:
+            return False
+
     def api_scan(self, file):
         try:
             if self.json["cloud_services"]:
                 with open(file, "rb") as f:
                     text = str(hashlib.md5(f.read()).hexdigest())
+                QApplication.processEvents()
                 strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
                 response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=5)
-                return response.status_code == 200 and float(xmlet.fromstring(response.text).find('.//e_level').text) > 50
-            return False
+                QApplication.processEvents()
+                if response.status_code == 200:
+                    label = str(xmlet.fromstring(response.text).find('.//malware').text).split('/')[1].split('.')
+                    level = int(float(xmlet.fromstring(response.text).find('.//e_level').text))
+                    return f"{label[0]}", level#/{label[1]}"
+            return False, False
         except:
-            return False
-
-    def sign_scan(self, file):
-        try:
-            with pefile.PE(file, fast_load=True) as pe:
-                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
-        except:
-            return True
+            return False, False
 
     def pe_scan(self, file):
         try:
@@ -881,21 +885,26 @@ class MainWindow_Controller(QMainWindow):
                             fn.append(str(func.name, "utf-8"))
                         except:
                             pass
-            out = self.pe.predict_all(fn)
-            v, w = out["Virus"], out["White"]
-            print(v, w, file)
-            if self.json["high_sensitive"]:
-                return v >= w
-            return v > w and v == 1.0
+            QApplication.processEvents()
+            return self.pe.predict(fn)
         except:
-            return False
+            return False, False
+
+    def sign_scan(self, file):
+        try:
+            with pefile.PE(file, fast_load=True) as pe:
+                return pe.OPTIONAL_HEADER.DATA_DIRECTORY[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]].VirtualAddress == 0
+        except:
+            return True
 
     def proc_scan(self, p):
         try:
+            if isinstance(p, str) and os.path.exists(p):
+                return self.start_scan(file)
             for entry in psutil.Process(p.pid).memory_maps():
                 file = entry.path.replace("\\", "/")
                 if ":/Windows" not in file and ":/Program" not in file:
-                    if self.api_scan(file) or self.pe_scan(file):
+                    if self.start_scan(file):
                         return True
             return False
         except:
@@ -1002,8 +1011,7 @@ class MainWindow_Controller(QMainWindow):
                 for i in Permission:
                     try:
                         win32api.RegDeleteValue(key,i)
-                        file = self.proc.exe().replace("\\", "/")
-                        self.kill_process(self.proc, "惡意行為攔截", file)
+                        self.kill_process(self.proc, "惡意行為攔截")
                     except:
                         pass
                 win32api.RegCloseKey(key)
@@ -1227,35 +1235,40 @@ class MainWindow_Controller(QMainWindow):
             Thread(target=self.protect_net_thread, daemon=True).start()
 
     def protect_proc_thread(self):
-        existing_processes = set()
+        existing_process = set()
         for p in psutil.process_iter():
-            existing_processes.add(p.pid)
-        psutil.Process(os.getpid()).nice(256)
+            existing_process.add(p.pid)
         while self.proc_protect:
             time.sleep(0.01)
+            new_process = set()
             for p in psutil.process_iter():
+                new_process.add(p.pid)
+            for pid in new_process - existing_process:
                 try:
-                    if psutil.pid_exists(p.pid) and p.pid not in existing_processes:
-                        name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-                        if file != self.pyas and file not in self.whitelist:
-                            self.lock_process(p, True)
-                            if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
-                                file = cmd[-1].split("'")[-2].replace("\\", "/")
-                                self.kill_process(p, "惡意腳本攔截", file)
-                            elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
-                                file = " ".join(cmd[2:]).replace("\\", "/")
-                                self.kill_process(p, "惡意腳本攔截", file)
-                            elif ":/Windows" in file and self.api_scan(cmd[-1]):
-                                file = cmd[-1].replace("\\", "/")
-                                self.kill_process(p, "惡意軟體攔截", file)
-                            elif ":/Windows" not in file and self.proc_scan(p):
-                                self.kill_process(p, "惡意軟體攔截", file)
-                            elif ":/Windows" not in file and self.sign_scan(file):
-                                self.proc = p
-                            self.lock_process(p, False)
-                            existing_processes.add(p.pid)
+                    p = psutil.Process(pid)
+                    self.handle_new_process(p)
                 except:
-                    self.lock_process(p, False)
+                    pass
+            existing_process = new_process
+
+    def handle_new_process(self, p):
+        try:
+            name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
+            if file != self.pyas and file not in self.whitelist:
+                self.lock_process(p, True)
+                if "powershell" in name and self.start_scan(cmd[-1].split("'")[-2]):
+                    self.kill_process(p, "惡意腳本攔截")
+                elif "cmd.exe" in name and self.start_scan(" ".join(cmd[2:])):
+                    self.kill_process(p, "惡意腳本攔截")
+                elif ":/Windows" in file and self.start_scan(cmd[-1]):
+                    self.kill_process(p, "惡意軟體攔截")
+                elif ":/Windows" not in file and self.proc_scan(p):
+                    self.kill_process(p, "惡意軟體攔截")
+                elif ":/Windows" not in file and self.sign_scan(file):
+                    self.proc = p
+                self.lock_process(p, False)
+        except:
+            self.lock_process(p, False)
 
     def lock_process(self, p, lock):
         try:
@@ -1264,14 +1277,17 @@ class MainWindow_Controller(QMainWindow):
             else:
                 psutil.Process(p.pid).resume()
         except:
-            return False
+            pass
 
-    def kill_process(self, parent, info, file):
+    def kill_process(self, parent, info):
         try:
-            parent.kill()
-            self.send_notify(self.trans(f"{info}: ")+file)
-            for child in parent.children(recursive=True):
-                child.kill()
+            if psutil.pid_exists(parent.pid):
+                file = parent.exe().replace("\\", "/")
+                self.send_notify(self.trans(f"{info}: ")+file)
+                for child in parent.children(recursive=True):
+                    child.kill()
+                parent.kill()
+            self.proc = None
         except:
             pass
 
@@ -1282,13 +1298,13 @@ class MainWindow_Controller(QMainWindow):
                 try:
                     fpath = str(f"C:/{file}").replace("\\", "/")
                     ftype = str(f".{fpath.split('.')[-1]}").lower()
-                    if action == 2 and ":/Users" in fpath and ftype in alist:
+                    if action == 2 and ":/Users" in fpath and "/AppData/" not in fpath:
                         file = self.proc.exe().replace("\\", "/")
-                        if "/AppData/" not in file and ":/Program" not in file:
-                            self.kill_process(self.proc, "勒索行為攔截", file)
+                        if ":/Program" not in file and ftype in alist:
+                            self.kill_process(self.proc, "勒索行為攔截")
                     elif action == 3 and ":/Users" in fpath and "/AppData/" not in fpath:
                         if os.path.getsize(fpath) <= 52428800 and ftype in slist:
-                            if self.api_scan(fpath) or self.pe_scan(fpath):
+                            if self.start_scan(fpath):
                                 os.remove(fpath)
                                 self.send_notify(self.trans("惡意軟體刪除: ")+fpath)
                 except:
@@ -1300,15 +1316,13 @@ class MainWindow_Controller(QMainWindow):
                 time.sleep(0.2)
                 with open(r"\\.\PhysicalDrive0", "r+b") as f:
                     if self.mbr_value[510:512] != b'\x55\xAA':
-                        file = self.proc.exe().replace("\\", "/")
-                        self.kill_process(self.proc, "惡意行為攔截", file)
+                        self.kill_process(self.proc, "惡意行為攔截")
                     elif f.read(512) != self.mbr_value:
                         f.seek(0)
                         f.write(self.mbr_value)
-                        file = self.proc.exe().replace("\\", "/")
-                        self.kill_process(self.proc, "惡意行為攔截", file)
+                        self.kill_process(self.proc, "惡意行為攔截")
             except:
-                pass
+                self.kill_process(self.proc, "惡意行為攔截")
 
     def protect_reg_thread(self):
         while self.reg_protect:
@@ -1327,10 +1341,9 @@ class MainWindow_Controller(QMainWindow):
                 time.sleep(0.2)
                 local = socket.gethostbyname(socket.gethostname())
                 for conn in self.proc.connections():
-                    file = self.proc.exe().replace("\\", "/")
                     if "/AppData/" not in file and ":/Program" not in file:
                         if conn.laddr.ip == local:
-                            self.kill_process(self.proc, "網路通訊攔截", file)
+                            self.kill_process(self.proc, "網路通訊攔截")
             except:
                 pass
 

PYAS_Model.json

@@ -1 +1 @@
-{"Virus": [261318414186602332274638176436767278092, 138027491891768042595443233665640385515, 110357087572968576943094470150101987119, 9625936089192481713091234633207548145, 89628141614819275279501592421270658611, 146573019333239184433892013297795962994, 264541877314875483358485439014616010241, 270110569967616684464025230399867156597, 317767290038007567692141082439138927345, 89378687258170412207570345845754816506, 295491687946453794463476073658069199320, 95651985866123533435079044203969354868, 127221069722257753511418504633757572348, 95651985871075295954016225919772204788, 95067756796967225976055101492886444145, 105638824952820428052005376209508641704, 18885788501897915917239730749935859793, 5340774248576581325353819949912031489, 10415246439899713411029597770193411184, 115920025419090664908814181482465136245, 230418814927598623996991522865620895293, 264555963058906459534362468816145940272, 116667039230079911205687280113439840357, 188173655331549916271106901837471791624, 10580035239361434345353152238353587444, 94568728460636955139799806421985758457, 799868415884320332536138129537778698, 307822865305226887780395456446154510073, 894545638663197114170691953086909252, 307408049865722049855100904733744729280, 281395069059347277039468499503754758797, 292376319578571219959135358926367053520, 22744055344958721368630687581251847176, 315759149185061187179391478424305256898, 255349869106614732679810651086278546442, 95562399119788972561845288789790891122, 145716650028545025053236635988099140033, 95315785306000038407304639293114375376, 133237106118017744142061791759548170883, 10159525814797641639514752130410024305, 273929518968914349238520945266572101465, 6803412338476848613694005563166320666, 94821380653995263056920242811808354032, 110684881900941951709859261701564766961, 105787286451833022929870383496648011249, 201783522381387157888199381457569830339, 105453663146661214242864956330772860016, 171522714730243767599747450471850906780, 106285815540718769887458629487913147505, 95232708608642156662699453866682554993, 106285815540717561551934825217444224113, 95559052534575041823542189821460810608, 173324173206867137081876750353781475864, 106280623246394143467097978838728292593, 305010456281757544171469123445447117681, 222253752239577871278657531622986138289, 95563048166632561463187231032275512432, 95559057605177442847140260259121040241, 108010814655804390841927389574188560953, 95318319972117721345303221798918291186, 94820584548412181705953186602301163257, 106198844586809641198104478887777078384, 94818541689698630943530703193593974512, 106119662154515582210221674170892663408, 143088668467296939342778818474878950647, 20881613063668797611160339818896853168, 179710050855676845982141937253360453053, 31018193447326218505924275935240096368, 105455042350511842344155948214062747248, 89670460543521034706908097860639104624, 105949568716338471638768471668461534962, 137521268273704145345759177480636558327, 107244620726926889373575057027717450762, 106201415362574605111426884001172884597, 110684892675972091428741019788518218489, 10332169700047182535948410013892054257, 105576376886969565715901422869178687219, 95145598865408927095247444731707367024, 105039010693725170460743583068113023705, 94987377577609631169063907051139341428, 100629312664727978741143555078594927795, 110684882592911957008875737340312369917, 148748393343889971317559945312215468786, 93989806751692355346109462915386284256, 100878647073583869926186814218125905113, 94662072863013290725024950240040430327, 105949568706125465724368274041836011250, 114380135952416886874949645426965728392, 94987377598500779420569757831453449840, 20215706740235798874506125693183790832, 110684912958381676190945511157408029425, 300558662558418689647121992472167150144, 132011016412170201801452237305311191441, 109023346904934388839803760995464461049, 336983008266790509743060629130917677774, 143175020845977086618208175741834533027, 172003113737697601641723035082316482624, 105787367661937540200783035652543688177, 95319034907171535697107975830043465952, 127216527016950104546694906326424083058, 124017012583193473160915936873388365506, 95065159985079431125978131216282192112, 10580035240599374384629243014119103732, 10496943991486934504031035936730090609, 31018193447326218505924275935240096368, 10248965448213412269216028810651597936, 100963036754215599502702416838888975610, 79036768232931406417351794113275712068, 105532141803327881065557146349585635569, 162357332045345094604141502928937491106, 116582703050825520068375122378543716978, 95150935027941497330695649661434404081, 176177498613631404614794194516575496896, 95484514342568128463910419849540603504, 105867687984072457600475937752904732400, 66833476002653370931812317778542555093, 9915421242395013439142248483403569396, 136271405179532594000996159423307548914, 47343025305025541868952332865095320248, 169502105399457292840800686344751518387, 274028058373054263663577471026209984675, 95650044561417669529155573147468110960, 100968228555433537808235270915390512872, 26Line truncated
+{"Unknown": [10199010580531108378153827424457992432, 20965212707052912989658218281213053170, 20963924773736013955013492889397430514, 20965222847950647661922877313293420786, 20963924773736089512877253988092938483, 10533913729454048551192748670221101302, 10497567570978277785165438149536581872, 230418814927598623996991522865620895293], "White": [126672244860282820431531292152154892541, 126555244512863767515621062938772454385, 78206639303253050193082960917406129821, 180439547362931620767428561827016696106, 96103515196312870469979178835907426963, 106202738889863580199047548478556282224, 260681472954591486442301293972682570259, 334352372173892944739362819086050576826, 270698534086324527574602815275595168743, 52278935817957542072232518657580445973, 99964490807793194121661552779445205157, 114471449979609419026325537602253303510, 170288120086869810213050150585452458992, 20129952829430162432875533418501193427, 266141180604311766657329911262256522695, 194231769680954789184967343915738715269, 137555894938392968938334822886799145665, 32033385634193095265531812355001705364, 110412723075988544148987035520371252041, 95564371670156926573557604030875376880, 95235309747885939408380636606625811569, 272762168699147334321583996672002378255, 95234011064914281942190040816173653105, 94471327154819245031506476509638106704, 95313696146069105288568328992515893493, 93984468150284189415663958982282127605, 191147052097100843670989027331488156725, 103210672664238242772979731817227685237, 56724333007221946388761990730009660128, 101562244577076015330628724737265682909, 97287175069805646577858533189449166301, 137063300177336245346774014048969161649, 316391968656924997605188916362257077459, 264287352948858755174876745019957203391, 127136776672701393662717729226704358773, 9912885994425979960261799249926495473, 214498205255495472884061693173662060219, 105039659248652423950583866198328679776, 106486519388821918892958052791862913681, 81533898116464931264738244322343722087, 127128973031678141900306064284785253496, 257976287344519798598519417614968543943, 95234579695571071996043856278635879538, 307531936139217865648235621101964847809, 205524205305644077365818951604097443015, 10082933643349790779259596715866791152, 105863211359421133420308580490619723120, 105536091507504387016141979202387910000, 115256152418524974755063297364983094641, 258226055192645594643924661804242821079, 184879672381654838626194080314169453584, 105909917863928976433791749005432917096, 34668429459089199253155684394504639701, 9333342038490638804353570140444499409, 49992947087053905927423189110869930637, 114390951894751980367497997972138956045, 40525380716593540848111929430426386129, 92531564279929657078344831661770634033, 137845158706024438551516917025209916775, 82711778578996712205456007623860083392, 142895363148849470268902285117702200512, 176210598858636561054489191954962668740, 133988075388031745460051108783604183680, 127463789261350104996635356465169505635, 98401956749501984262112138828559240544, 105619903475864025251671385889627380849, 194216192765620392180514937530431948487, 178730848644410936934440792379530771324, 258767967557372966404648755263173813716, 95568909833307793735851930883495894385, 105203216600314032187918420804040465776, 10160172324731669179270431009861737585, 95562338257159239457022778648277753201, 125705675445940363792857463789011840389, 105782103246308081595321955114562886777, 34490061240648476397849656073168201108, 337793686977585440073129666111702532467, 278253338747731733314329375842609871921, 204788843742030229839080201679229506773, 106117654063199359331238217293466812006, 123266687541636144245366511635599982231, 113845713591553304589832425329269218672, 102400300404095555238772811174816483363, 115752031916027952368786798048662461543, 205193551069866139019248248605938239445, 101437234347196055762008445071888009636, 148030553843923537774182040572301348817, 95562399131158503793285318098946563443, 144743835053038288880188325484490464627, 329456512868359962875761871381429648792, 214132526311861388081693372283346711315, 212807863125887894065170197859985748755, 90639505994802779364701320439314232445, 109312881611100283088661575235655027037, 268695571549372555579983860480753996530, 276556254823007156956265006607247855228, 158532724662396204460585683955318721251, 190236918274156159301867868769173894064, 115505281197039501762156314342977388146, 181151739907962908273686170106830254275, 103040304820632656358846714092274654455, 283839353929015376840553872262568182165, 126305356110326106528653817459839286387, 232772214119775911616044955505922667440, 267224571901232164108563912343781345315, 248870611769713486967773923305072182805, 94401261442397178213607895041941511616, 126697942675733486251713755064939650169, 52680527483000227468312744969526057584, 100468409853345213529992161170862574067, 195546595259106600444307572967932415185, 121396668310321681197001161772784753777, 102772203717048361679815565428970429489, 118636962645139146202043096156604144755, 130735009156835Line truncated

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.0.6',
+version='3.0.8',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",