using System;
using System.IO;
using System.Security.Cryptography;
using System.Collections.Generic;
using System.Linq;

public class MalwareProtectionSystem
{
    // Collection of known malware signatures
    private static HashSet<string> KnownMalwareSignatures = new HashSet<string>
    {
        "7a38a4e345a5f9f5e4f3a5b2c1d9e8f7", // Example malware signature
        "b6c3d8a2f1e9d4c7b5a3f6e2d8c1b4a7"
    };

    // Scan file for potential malware
    public static bool ScanFileForMalware(string filePath)
    {
        try
        {
            // Calculate file hash
            string fileHash = CalculateFileHash(filePath);

            // Check against known malware signatures
            if (KnownMalwareSignatures.Contains(fileHash))
            {
                Console.WriteLine($"Malware detected in file: {filePath}");
                return false;
            }

            // Check suspicious file extensions
            string[] suspiciousExtensions = { ".exe", ".bat", ".cmd", ".vbs" };
            string fileExtension = Path.GetExtension(filePath).ToLower();
            
            if (suspiciousExtensions.Contains(fileExtension))
            {
                Console.WriteLine($"Suspicious file detected: {filePath}");
                return false;
            }

            Console.WriteLine($"File is safe: {filePath}");
            return true;
        }
        catch (Exception ex)
        {
            Console.WriteLine($"Error scanning file: {ex.Message}");
            return false;
        }
    }

    // Calculate file hash using SHA256
    private static string CalculateFileHash(string filePath)
    {
        using (var sha256 = SHA256.Create())
        {
            using (var stream = File.OpenRead(filePath))
            {
                var hash = sha256.ComputeHash(stream);
                return BitConverter.ToString(hash).Replace("-", "").ToLowerInvariant();
            }
        }
    }

    // Monitor suspicious processes
    public static void MonitorSuspiciousProcesses()
    {
        // List of suspicious process names
        string[] suspiciousProcesses =
        {
            "keylogger",
            "remoteshell",
            "networksniff"
        };

        var runningProcesses = System.Diagnostics.Process.GetProcesses();
        
        foreach (var process in runningProcesses)
        {
            if (suspiciousProcesses.Any(p => process.ProcessName.ToLower().Contains(p)))
            {
                Console.WriteLine($"Suspicious process detected: {process.ProcessName}");
            }
        }
    }

    // Main method for demonstration
    public static void Main(string[] args)
    {
        Console.WriteLine("Malware Protection System Started");

        // For online compiler compatibility, use a sample file path
        string sampleFilePath = "sample.txt";
        
        // Create a sample file for testing
        File.WriteAllText(sampleFilePath, "This is a test file");

        // Scan the sample file
        ScanFileForMalware(sampleFilePath);

        // Monitor suspicious processes
        MonitorSuspiciousProcesses();
    }
}