Add files via upload

Engine/Properties/train_server.py

@@ -191,7 +191,7 @@ def train_process(X, y, feature_names):
     n_neg = (y_train == 0).sum()
     
     base_weight = n_neg / n_pos if n_pos > 0 else 1.0
-    weight_ratio_target = 0.005
+    weight_ratio_target = 0.01
     final_pos_weight = base_weight * weight_ratio_target
     
     print(f"[*] Sample distribution: Safe={n_neg}, Malware={n_pos}")

PYAS.py

@@ -366,7 +366,7 @@ class _MainMixin:
         self.lock_io = threading.RLock()
 
         self.pyas_default = {
-            "version": "3.6.8",
+            "version": "3.6.9",
             "api_host": "https://pyas-security.com/",
             "api_key": "fBRZxYS1UxykM-qzNOlKOEl63WILzlvgNMn6QfsG6FXCAAIktCrOPTAfY5_hEyuZ",
             "suffix": [".exe", ".dll", ".sys", ".ocx", ".scr", ".efi", ".acm", ".ax", ".cpl", ".drv", ".com", ".mui", ".pyd", ".wfx", ".api", ".awx", ".rll", ".winmd"],
@@ -460,20 +460,20 @@ class _MainMixin:
                         self.pyas_config = copy.deepcopy(self.pyas_default)
                         self.pyas_config.update(data)
 
-                    self.pyas_config["version"] = self.pyas_default["version"]
-                    whitelist_metadata_updated = False
-                    for item in self.pyas_config.get("white_list", []):
-                        if not isinstance(item, dict) or not item.get("file") or "is_dir" in item:
-                            continue
-
-                        item_path = self.norm_path(item["file"], must_exist=False)
-                        if item_path and os.path.exists(item_path):
-                            item["is_dir"] = os.path.isdir(item_path)
-                            whitelist_metadata_updated = True
-
-                    if whitelist_metadata_updated:
-                        self.save_config()
-                except Exception as e:
+                    self.pyas_config["version"] = self.pyas_default["version"]
+                    whitelist_metadata_updated = False
+                    for item in self.pyas_config.get("white_list", []):
+                        if not isinstance(item, dict) or not item.get("file") or "is_dir" in item:
+                            continue
+
+                        item_path = self.norm_path(item["file"], must_exist=False)
+                        if item_path and os.path.exists(item_path):
+                            item["is_dir"] = os.path.isdir(item_path)
+                            whitelist_metadata_updated = True
+
+                    if whitelist_metadata_updated:
+                        self.save_config()
+                except Exception as e:
                     self.pyas_config = copy.deepcopy(self.pyas_default)
                     self.write_log("WARN", "load_config", detail=str(e), success=False)
 
@@ -524,8 +524,8 @@ class _MainMixin:
 
                     elif key == "context_switch":
                         self.register_context_menu(True)
-                    elif key == "autostart_switch":
-                        success = self.manage_autostart(True)
+                    elif key == "autostart_switch":
+                        success = self.manage_autostart(True)
 
                 except Exception as e:
                     self.write_log("WARN", "Feature Start", detail=str(e), success=False)
@@ -536,8 +536,8 @@ class _MainMixin:
 
                 elif key == "context_switch":
                     self.register_context_menu(False)
-                elif key == "autostart_switch":
-                    success = self.manage_autostart(False)
+                elif key == "autostart_switch":
+                    success = self.manage_autostart(False)
 
                 elif key == "document_switch":
                     self._cancel_pending_file_scans()
@@ -1122,17 +1122,17 @@ class _MainMixin:
                 elif full_path.startswith("HKCC"):
                     full_path = full_path.replace("HKCC", "HKEY_CURRENT_CONFIG", 1)
 
-                self._run_windows_tool(
-                    ("taskkill.exe",),
-                    ["/F", "/IM", "regedit.exe"],
-                    stdout=subprocess.DEVNULL,
-                    stderr=subprocess.DEVNULL
-                )
-                self._reg_write(winreg.HKEY_CURRENT_USER, r"Software\Microsoft\Windows\CurrentVersion\Applets\Regedit", "LastKey", winreg.REG_SZ, full_path)
-                regedit = self._find_windows_tool("regedit.exe")
-                if not regedit:
-                    return False
-                subprocess.Popen([regedit])
+                self._run_windows_tool(
+                    ("taskkill.exe",),
+                    ["/F", "/IM", "regedit.exe"],
+                    stdout=subprocess.DEVNULL,
+                    stderr=subprocess.DEVNULL
+                )
+                self._reg_write(winreg.HKEY_CURRENT_USER, r"Software\Microsoft\Windows\CurrentVersion\Applets\Regedit", "LastKey", winreg.REG_SZ, full_path)
+                regedit = self._find_windows_tool("regedit.exe")
+                if not regedit:
+                    return False
+                subprocess.Popen([regedit])
 
                 return True
             except Exception:
@@ -1141,12 +1141,12 @@ class _MainMixin:
 
         if os.path.exists(expanded_path):
             try:
-                clean_path = os.path.normpath(expanded_path)
-                explorer = self._find_windows_tool("explorer.exe")
-                if not explorer:
-                    return False
-                subprocess.Popen([explorer, "/select,", clean_path])
-                return True
+                clean_path = os.path.normpath(expanded_path)
+                explorer = self._find_windows_tool("explorer.exe")
+                if not explorer:
+                    return False
+                subprocess.Popen([explorer, "/select,", clean_path])
+                return True
 
             except Exception:
                 pass

PYAS_Inno.iss

@@ -1,6 +1,6 @@
 #define AppId "{{a7d7bac3-93b8-4630-8308-c7a56bf7fdf4}"
 #define AppName "PYAS"
-#define AppVersion "3.6.8.0"
+#define AppVersion "3.6.9.0"
 #define AppPublisher "PYAS Security"
 #define AppURL "https://github.com/87owo/PYAS"
 #define AppExeName "PYAS.exe"

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.6.8.0',
+version='3.6.9.0',
 company_name="PYAS Security",
 file_description="PYAS Security Antivirus",
 internal_name="PYAS",

Plugins/Rules/Rules_Driver_P1.json

@@ -246,6 +246,7 @@
             "InitiatorExclude": [
                 "*\\PYAS.exe",
                 "*\\Huorong\\Sysdiag\\bin\\sysclean.exe",
+                "*\\Dell\\SARemediation\\agent\\DellSupportAssistRemedationService.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
@@ -253,6 +254,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\ReAgentc.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\UUS\\amd64\\wuaucltcore.exe",
                 "\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe",
@@ -265,6 +267,10 @@
                 "\\Device\\HarddiskVolume*\\Boot\\*",
                 "\\Device\\HarddiskVolume*\\Recovery\\*",
             ],
+            "TargetExclude": [
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\Recovery\\ReAgent.xml",
+                "\\Device\\HarddiskVolume*\\Recovery\\OEM\\Logs\\Versions.ini",
+            ],
             "Operations": [
                 "Write",
                 "Delete",
@@ -652,6 +658,7 @@
                 "*\\Sources\\SetupHost.exe",
                 "*\\Work\\*\\DismHost.exe",
                 "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
+                "*\\Huorong\\Sysdiag\\bin\\HRUpdate.exe",
                 "*\\360Safe.exe",
                 "*\\PYAS.exe",
             ],
@@ -663,6 +670,9 @@
                 "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option",
                 "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option\\*",
             ],
+            "TargetExclude": [
+                "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\SafeBoot\\Network\\HipsDaemon",
+            ],
             "Operations": [
                 "Write",
                 "Delete",
@@ -676,16 +686,17 @@
             "Kill": false,
             "Category": "Registry",
             "InitiatorExclude": [
+                "*\\PYAS.exe",
                 "*\\Sources\\SetupHost.exe",
                 "*\\Work\\*\\DismHost.exe",
-                "*\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
-                "*\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe",
-                "*\\Windows\\System32\\MoUsoCoreWorker.exe",
-                "*\\Windows\\System32\\Sysprep\\sysprep.exe",
-                "*\\Windows\\System32\\oobe\\*",
-                "*\\Windows\\System32\\svchost.exe",
-                "*\\Windows\\explorer.exe",
-                "*\\PYAS.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\MoUsoCoreWorker.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\Sysprep\\sysprep.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\oobe\\*",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
             ],
             "Target": [
                 "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\OOBEInProgress",

README.md

@@ -134,6 +134,12 @@ The machine learning-based virus scanning engine training achieved extremely hig
 
 <img width="895" height="1097" alt="train" src="https://github.com/user-attachments/assets/fa7cf0e2-01a1-4234-9358-718c2b8a2c9a" />
 
+## Rule Editor
+
+PYAS antivirus software driver protection rule editor, developed using Blockly. Included in the Releases.
+
+<img width="2559" height="1271" alt="image" src="https://github.com/user-attachments/assets/29a816a8-3bf9-4e1c-b881-7336676ad7f9" />
+
 ## Support System
 
 Please ensure your computer supports Microsoft Visual C++ 2015-2022 Redistributable and Edge Webview2.