Версия 1.1: Подтверждение при автосканировании скриптов и PDF; подтве…

…рждение файлов, загруженных из Telegram Desktop, исправления перевода
ImMALWARE · Jul 8, 2024 · 74fcbff · 74fcbff
1 parent a996001
commit 74fcbff
Show file tree

Hide file tree

Showing 10 changed files with 194 additions and 28 deletions.
diff --git a/App.xaml.cs b/App.xaml.cs
@@ -53,7 +53,7 @@ protected override void OnStartup(StartupEventArgs e) {
             if (isOnlyInstance) {
                 NotifyIcon notifyIcon = new() {
                     Visible = true,
-                    Icon = new Icon(AppDomain.CurrentDomain.BaseDirectory+"\\res\\at.ico"),
+                    Icon = new Icon(AppDomain.CurrentDomain.BaseDirectory + "at.ico"),
                     Text = AutoTotal.Properties.Resources.WorkingInBackground,
                     ContextMenuStrip = new ContextMenuStrip {
                         Items = {

diff --git a/AutoTotal.csproj b/AutoTotal.csproj
@@ -22,6 +22,9 @@
     <PackageOutputPath>$(OutputPath)</PackageOutputPath>
     <NeutralLanguage>ru</NeutralLanguage>
     <PackageReadmeFile>README.md</PackageReadmeFile>
+    <AssemblyVersion>1.1.0.0</AssemblyVersion>
+    <FileVersion>1.1</FileVersion>
+    <Version>$(VersionPrefix)</Version>
   </PropertyGroup>
 
   <ItemGroup>
@@ -31,12 +34,14 @@
   </ItemGroup>
 
   <ItemGroup>
-    <Content Include="at.ico" />
+    <Content Include="at.ico">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </Content>
   </ItemGroup>
 
   <ItemGroup>
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="Notification.Wpf" Version="7.0.0.2" />
+    <PackageReference Include="Notification.Wpf" Version="8.0.0" />
   </ItemGroup>
 
   <ItemGroup>

diff --git a/FolderSpy+Utils.cs b/FolderSpy+Utils.cs
@@ -23,6 +23,9 @@ internal static class FolderSpy {
             ".ppam", ".ppsm", ".pptm", ".py", ".pyc", ".pyo", ".xlam", ".xlsm", ".xltm", ".hta",
             ".dll", ".sys", ".drv", ".zip", ".rar", ".7z", ".iso", ".img", ".tar", ".wim",
             ".xz"};
+        private static readonly string[] confirm_extensions = new string[9] {
+            ".bat", ".cmd", ".js", ".pdf", ".ps1", ".py", ".pyc", ".pyo", ".vbs"
+        };
 
         public static void Add(string? path) {
             if (path == null) return;
@@ -45,9 +48,50 @@ public static void Remove(string? path) {
 
         private static async Task OnFileCreated(object sender, FileSystemEventArgs e) {
             if (extensions.Contains(Path.GetExtension(e.FullPath), StringComparer.OrdinalIgnoreCase)) {
-                if (Properties.Settings.Default.BlockFiles) Blocker.Block(e.FullPath);
-                await Utils.ScanFile(e.FullPath);
-                if (Properties.Settings.Default.BlockFiles) Blocker.Unblock(e.FullPath);
+
+                async Task ScanTask() {
+                    if (Properties.Settings.Default.BlockFiles) Blocker.Block(e.FullPath);
+                    await Utils.ScanFile(e.FullPath);
+                    if (Properties.Settings.Default.BlockFiles) Blocker.Unblock(e.FullPath);
+                }
+
+                if (e.Name!.Contains("AyuGram Desktop\\") || e.Name.Contains("Telegram Desktop\\")) {
+                    TaskCompletionSource<bool> notificationWaiter = new();
+                    System.Windows.Application.Current.Dispatcher.Invoke(() => {
+                        Data.notificationManager.Show(new NotificationContent {
+                            Title = Properties.Resources.DidFileDownload.Replace("%name%", Path.GetFileName(e.Name)),
+                            Message = Properties.Resources.CantTrackTelegram,
+                            Type = NotificationType.Notification,
+                            TrimType = NotificationTextTrimType.NoTrim,
+                            Icon = Icon.ExtractAssociatedIcon(e.FullPath)?.ToBitmap().ToBitmapImage(),
+                            LeftButtonContent = Properties.Resources.Downloaded,
+                            LeftButtonAction = () => notificationWaiter.TrySetResult(true),
+                            RightButtonContent = Properties.Resources.DontScan,
+                            RightButtonAction = () => notificationWaiter.TrySetResult(false)
+                        }, expirationTime: Timeout.InfiniteTimeSpan, onClose: () => notificationWaiter.TrySetResult(true));
+                    });
+                    await notificationWaiter.Task;
+                    if (notificationWaiter.Task.Result) await ScanTask();
+                    return;
+                }
+
+                if (confirm_extensions.Contains(Path.GetExtension(e.FullPath), StringComparer.OrdinalIgnoreCase)) {
+                    System.Windows.Application.Current.Dispatcher.Invoke(() => {
+                        Data.notificationManager.Show(new NotificationContent {
+                            Title = $"{Properties.Resources.Scan} {Path.GetFileName(e.Name)}?",
+                            Message = Properties.Resources.UploadedOnlyUponConfirmation,
+                            Type = NotificationType.None,
+                            TrimType = NotificationTextTrimType.NoTrim,
+                            Icon = Icon.ExtractAssociatedIcon(e.FullPath)?.ToBitmap().ToBitmapImage(),
+                            LeftButtonAction = async () => await ScanTask(),
+                            LeftButtonContent = Properties.Resources.Scan,
+                            RightButtonContent = Properties.Resources.No,
+                            RightButtonAction = () => {},
+                        }, expirationTime: TimeSpan.FromSeconds(300));
+                    });
+                    return;
+                }
+                await ScanTask();
             }
         }
     }
@@ -95,7 +139,7 @@ public static async Task ScanFile(string path, bool ContinueRun = true) {
             string md5 = BitConverter.ToString(MD5.Create().ComputeHash(File.OpenRead(path))).Replace("-", "").ToLower();
             using HttpClient httpClient = new();
             httpClient.DefaultRequestHeaders.Add("x-apikey", Properties.Settings.Default.VTKey);
-            
+
             HttpResponseMessage response;
             try {
                 response = await httpClient.GetAsync("https://www.virustotal.com/api/v3/files/" + md5);
@@ -239,7 +283,7 @@ public static async Task ScanFile(string path, bool ContinueRun = true) {
                     Message = detects + Properties.Resources.AVsDetected
                 };
                 if (detects == 0) {
-                    content.Type = NotificationType.Notification;
+                    content.Type = NotificationType.Information;
                     content.Title = Path.GetFileName(path) + Properties.Resources.Clean;
                     content.Message = Properties.Resources._0detects;
                     content.Icon = new BitmapImage(new Uri("pack://application:,,,/res/like.png"));
@@ -249,16 +293,16 @@ public static async Task ScanFile(string path, bool ContinueRun = true) {
                     content.Title = Path.GetFileName(path) + Properties.Resources.Suspicious;
                     content.LeftButtonAction = () => Process.Start("explorer", "https://virustotal.com/gui/file/" + md5);
                     content.LeftButtonContent = Properties.Resources.ShowReport;
-                    content.RightButtonContent = Properties.Resources.Delete;
                     content.RightButtonAction = () => { File.Delete(path); };
+                    content.RightButtonContent = Properties.Resources.Delete;
                 }
                 else {
                     content.Type = NotificationType.Error;
                     content.Title = Path.GetFileName(path) + Properties.Resources.Dangerous;
                     content.LeftButtonAction = () => Process.Start("explorer", "https://virustotal.com/gui/file/" + md5);
                     content.LeftButtonContent = Properties.Resources.ShowReport;
-                    content.RightButtonContent = Properties.Resources.Delete;
                     content.RightButtonAction = () => { File.Delete(path); };
+                    content.RightButtonContent = Properties.Resources.Delete;
                 }
                 Data.notificationManager.Show(content, expirationTime: TimeSpan.FromSeconds(10), onClose: () => notificationWaiter.TrySetResult(true));
             });

diff --git a/Properties/Resources.Designer.cs b/Properties/Resources.Designer.cs
diff --git a/Properties/Resources.resx b/Properties/Resources.resx
@@ -141,6 +141,9 @@
   <data name="BlockFiles" xml:space="preserve">
     <value>Block files until scanned</value>
   </data>
+  <data name="CantTrackTelegram" xml:space="preserve">
+    <value>I cannot track when the download from Telegram Desktop will finish, so you will need to confirm it manually</value>
+  </data>
   <data name="ChangeVTKey" xml:space="preserve">
     <value>Change VirusTotal API key</value>
   </data>
@@ -165,9 +168,18 @@
   <data name="Delete" xml:space="preserve">
     <value>Delete file</value>
   </data>
+  <data name="DidFileDownload" xml:space="preserve">
+    <value>Is %name% already download?</value>
+  </data>
   <data name="DisappearedFolder" xml:space="preserve">
     <value>Non-existing folder was deleted from the list</value>
   </data>
+  <data name="DontScan" xml:space="preserve">
+    <value>Do not scan</value>
+  </data>
+  <data name="Downloaded" xml:space="preserve">
+    <value>Downloaded!</value>
+  </data>
   <data name="Exit" xml:space="preserve">
     <value>Exit</value>
   </data>
@@ -198,6 +210,9 @@
   <data name="MinusFolder" xml:space="preserve">
     <value>- folder</value>
   </data>
+  <data name="No" xml:space="preserve">
+    <value>No</value>
+  </data>
   <data name="PlusFolder" xml:space="preserve">
     <value>+ folder</value>
   </data>
@@ -216,6 +231,9 @@
   <data name="Save" xml:space="preserve">
     <value>Save</value>
   </data>
+  <data name="Scan" xml:space="preserve">
+    <value>Scan</value>
+  </data>
   <data name="ScanError" xml:space="preserve">
     <value>AutoTotal — Scan error</value>
   </data>
@@ -240,6 +258,9 @@
   <data name="TitleLimit" xml:space="preserve">
     <value>AutoTotal — VirusTotal API limit</value>
   </data>
+  <data name="UploadedOnlyUponConfirmation" xml:space="preserve">
+    <value>Scripts and PDFs are uploaded to VT only upon confirmation</value>
+  </data>
   <data name="Uploading" xml:space="preserve">
     <value>Uploading %name% to VirusTotal</value>
   </data>

diff --git a/Properties/Resources.ru-RU.resx b/Properties/Resources.ru-RU.resx
@@ -141,12 +141,18 @@
   <data name="BlockFiles" xml:space="preserve">
     <value>Блокировать файлы на время сканирования</value>
   </data>
+  <data name="CantTrackTelegram" xml:space="preserve">
+    <value>Я не могу отследить, когда загрузка из Telegram Desktop завершится, поэтому придётся подтвердить скачивание вручную</value>
+  </data>
   <data name="ChangeVTKey" xml:space="preserve">
     <value>Изменить ключ API VirusTotal</value>
   </data>
   <data name="ChangingVTKey" xml:space="preserve">
     <value>Изменение ключа API VirusTotal</value>
   </data>
+  <data name="CheckingKey" xml:space="preserve">
+    <value>Проверка ключа</value>
+  </data>
   <data name="CheckInternetConnection" xml:space="preserve">
     <value>Файл %name% не просканирован! Проверьте подключение к интернету!</value>
   </data>
@@ -162,9 +168,18 @@
   <data name="Delete" xml:space="preserve">
     <value>Удалить файл</value>
   </data>
+  <data name="DidFileDownload" xml:space="preserve">
+    <value>%name% уже скачался?</value>
+  </data>
   <data name="DisappearedFolder" xml:space="preserve">
     <value>Несуществующая папка была удалена из списка</value>
   </data>
+  <data name="DontScan" xml:space="preserve">
+    <value>Не сканировать</value>
+  </data>
+  <data name="Downloaded" xml:space="preserve">
+    <value>Скачался!</value>
+  </data>
   <data name="Exit" xml:space="preserve">
     <value>Выход</value>
   </data>
@@ -195,6 +210,9 @@
   <data name="MinusFolder" xml:space="preserve">
     <value>- папка</value>
   </data>
+  <data name="No" xml:space="preserve">
+    <value>Нет</value>
+  </data>
   <data name="PlusFolder" xml:space="preserve">
     <value>+ папка</value>
   </data>
@@ -213,6 +231,9 @@
   <data name="Save" xml:space="preserve">
     <value>Сохранить</value>
   </data>
+  <data name="Scan" xml:space="preserve">
+    <value>Сканировать</value>
+  </data>
   <data name="ScanError" xml:space="preserve">
     <value>AutoTotal - ошибка сканирования</value>
   </data>
@@ -234,6 +255,12 @@
   <data name="Suspicious" xml:space="preserve">
     <value> подозрителен!</value>
   </data>
+  <data name="TitleLimit" xml:space="preserve">
+    <value>AutoTotal — лимит API VirusTotal</value>
+  </data>
+  <data name="UploadedOnlyUponConfirmation" xml:space="preserve">
+    <value>Скрипты и PDF загружаются на VT только по подтверждению</value>
+  </data>
   <data name="Uploading" xml:space="preserve">
     <value>Отправка %name% на VirusTotal</value>
   </data>

diff --git a/README.md b/README.md
@@ -7,15 +7,18 @@
 ## Больше не нужно паранойить о том, что скачанный файл небезопасен
 ![0 детектов](https://i.imgur.com/UzKeKPO.png) \
 ![2 детекта](https://i.imgur.com/etlhGRl.png) \
-![много детектов](https://i.imgur.com/6QK5Fx4.png)
+![Много детектов](https://i.imgur.com/6QK5Fx4.png)
 
 ## Используйте свой ключ API VirusTotal
 ![Изменение API ключа](https://i.imgur.com/LUl2T5a.png)
 
 ## Вы не сможете случайно запустить вредоносный файл до завершения сканирование
-### Программа заблокирует файлы на время сканирования
+### Блокировка файлов на время сканирования (выключается в настройках)
 ![Блокировка](https://i.imgur.com/cisYm4M.png)
 
-### Удобно просканировать файлы можно вручную
+## Удобно просканировать файлы можно вручную
 ![Из трея](https://i.imgur.com/QhTVzMz.png) \
-![Из проводника](https://i.imgur.com/YcztIOh.png)
+![Из проводника](https://i.imgur.com/YcztIOh.png)
+
+## Подтверждение при автосканировании скриптов и PDF (чтобы личные файлы случайно не отправились)
+![Демонстрация](https://i.imgur.com/sQzw2RV.png)