refactor: 合并 avdetect 到 systeminfo，修复杀软检测误报

- 将 avdetect 的进程匹配逻辑合并到 systeminfo 插件
- 修复进程匹配使用 Contains 导致大量误报，改为精确匹配
- 修正 auto.json 中 Microsoft Security Essentials 为 Microsoft Defender
- 使用 map 索引优化进程匹配性能
- 清理废弃的 envinfo/avdetect i18n key

common/flag.go

@@ -113,7 +113,7 @@ func Flag(Info *HostInfo) error {
 	flag.Int64Var(&fv.GlobalTimeout, "gt", 180, i18n.GetText("flag_global_timeout"))
 	flag.BoolVar(&fv.DisablePing, "np", false, i18n.GetText("flag_disable_ping"))
 	flag.BoolVar(&fv.DisableTcpProbe, "ntp", false, i18n.GetText("flag_disable_tcp_probe"))
-	flag.StringVar(&fv.LocalPlugin, "local", "", "指定本地插件名称 (如: cleaner, avdetect, keylogger 等)")
+	flag.StringVar(&fv.LocalPlugin, "local", "", "指定本地插件名称 (如: cleaner, systeminfo, keylogger 等)")
 	flag.BoolVar(&fv.AliveOnly, "ao", false, i18n.GetText("flag_alive_only"))
 
 	// ═════════════════════════════════════════════════

common/i18n/locales/en.yaml

@@ -564,9 +564,6 @@ keylogger_save_failed:
 keylogger_no_input:
   other: "No keyboard input captured"
 
-# Environment info
-envinfo_sensitive:
-  other: "Found sensitive environment variable: {{.Arg1}}"
 
 # Windows WMI
 winwmi_success:
@@ -594,16 +591,6 @@ forwardshell_client_connected:
 forwardshell_read_failed:
   other: "Failed to read client command: {{.Arg1}}"
 
-# AV detection
-avdetect_load_failed:
-  other: "Failed to load AV database: {{.Arg1}}"
-avdetect_loaded:
-  other: "Loaded {{.Arg1}} AV product info"
-avdetect_found:
-  other: "Detected AV: {{.Arg1}} ({{.Arg2}} processes)"
-avdetect_process:
-  other: "  - {{.Arg1}}"
-
 # Windows startup folder
 winstartup_success:
   other: "Windows startup folder persistence completed: {{.Arg1}} methods"
@@ -709,6 +696,8 @@ systeminfo_patches:
   other: "Installed Patches: {{.Arg1}}"
 systeminfo_antivirus:
   other: "Antivirus Detected: {{.Arg1}}"
+systeminfo_av_process:
+  other: "  - {{.Arg1}}"
 systeminfo_sudo:
   other: "Sudo Privileges: {{.Arg1}}"
 systeminfo_macos_detail:

common/i18n/locales/zh.yaml

@@ -564,10 +564,6 @@ keylogger_save_failed:
 keylogger_no_input:
   other: "没有捕获到键盘输入"
 
-# 环境变量信息
-envinfo_sensitive:
-  other: "发现敏感环境变量: {{.Arg1}}"
-
 # Windows WMI
 winwmi_success:
   other: "Windows WMI事件订阅持久化完成: {{.Arg1}}个项目"
@@ -594,16 +590,6 @@ forwardshell_client_connected:
 forwardshell_read_failed:
   other: "读取客户端命令失败: {{.Arg1}}"
 
-# AV检测
-avdetect_load_failed:
-  other: "加载AV数据库失败: {{.Arg1}}"
-avdetect_loaded:
-  other: "加载了 {{.Arg1}} 个AV产品信息"
-avdetect_found:
-  other: "检测到AV: {{.Arg1}} ({{.Arg2}}个进程)"
-avdetect_process:
-  other: "  - {{.Arg1}}"
-
 # Windows启动文件夹
 winstartup_success:
   other: "Windows启动文件夹持久化完成: {{.Arg1}}个方法"
@@ -709,6 +695,8 @@ systeminfo_patches:
   other: "已安装补丁: {{.Arg1}}个"
 systeminfo_antivirus:
   other: "检测到杀软: {{.Arg1}}"
+systeminfo_av_process:
+  other: "  - {{.Arg1}}"
 systeminfo_sudo:
   other: "sudo权限: {{.Arg1}}"
 systeminfo_macos_detail:

plugins/local/auto.json

@@ -406,7 +406,7 @@
         ],
         "url": "https://www.mcafee.com/en-us"
     },
-    "Microsoft Security Essentials": {
+    "Microsoft Defender(Windows Defender)": {
         "processes": [
             "MsMpEng.exe",
             "msseces.exe",
@@ -421,7 +421,7 @@
             "MSASCuiL.exe",
             "SecurityHealthService.exe"
         ],
-        "url": "https://support.microsoft.com/en-us/help/17150/windows-7-what-is-microsoft-security-essentials"
+        "url": "https://www.microsoft.com/en-us/windows/comprehensive-security"
     },
     "NANO-Antivirus": {
         "processes": [

plugins/local/avdetect.go

@@ -1,205 +0,0 @@
-//go:build (plugin_avdetect || !plugin_selective) && !no_local
-
-package local
-
-import (
-	"context"
-	_ "embed"
-	"encoding/json"
-	"fmt"
-	"os/exec"
-	"runtime"
-	"strings"
-
-	"github.com/shadow1ng/fscan/common"
-	"github.com/shadow1ng/fscan/common/i18n"
-	"github.com/shadow1ng/fscan/plugins"
-)
-
-//go:embed auto.json
-var avDatabase []byte
-
-// AVProduct AV产品信息结构
-type AVProduct struct {
-	Processes []string `json:"processes"`
-	URL       string   `json:"url"`
-}
-
-// AVDetectPlugin 杀软检测插件
-// 设计哲学："做一件事并做好" - 专注AV检测
-// - 使用JSON数据库加载AV信息
-// - 删除复杂的结果结构体
-// - 跨平台支持，运行时适配
-type AVDetectPlugin struct {
-	plugins.BasePlugin
-	avProducts map[string]AVProduct
-}
-
-// NewAVDetectPlugin 创建AV检测插件
-func NewAVDetectPlugin() *AVDetectPlugin {
-	plugin := &AVDetectPlugin{
-		BasePlugin: plugins.NewBasePlugin("avdetect"),
-		avProducts: make(map[string]AVProduct),
-	}
-
-	// 加载AV数据库
-	if err := json.Unmarshal(avDatabase, &plugin.avProducts); err != nil {
-		common.LogError(i18n.Tr("avdetect_load_failed", err))
-	} else {
-		common.LogInfo(i18n.Tr("avdetect_loaded", len(plugin.avProducts)))
-	}
-
-	return plugin
-}
-
-// Scan 执行AV/EDR检测 - 直接、有效
-func (p *AVDetectPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
-	var output strings.Builder
-	var detectedAVs []string
-
-	output.WriteString("=== AV/EDR检测 ===\n")
-
-	// 获取运行进程
-	processes := p.getRunningProcesses()
-	if len(processes) == 0 {
-		return &plugins.Result{
-			Success: false,
-			Output:  "无法获取进程列表",
-			Error:   fmt.Errorf("进程列表获取失败"),
-		}
-	}
-
-	_, _ = fmt.Fprintf(&output, "扫描进程数: %d\n\n", len(processes))
-
-	// 检测AV产品 - 使用JSON数据库
-	for avName, avProduct := range p.avProducts {
-		var foundProcesses []string
-
-		for _, avProcess := range avProduct.Processes {
-			for _, runningProcess := range processes {
-				// 提取进程名部分进行匹配（去除PID信息）
-				processName := runningProcess
-				if strings.Contains(runningProcess, " (PID: ") {
-					processName = strings.Split(runningProcess, " (PID: ")[0]
-				}
-
-				// 简单字符串匹配，忽略大小写
-				if strings.Contains(strings.ToLower(processName), strings.ToLower(avProcess)) {
-					foundProcesses = append(foundProcesses, runningProcess)
-				}
-			}
-		}
-
-		if len(foundProcesses) > 0 {
-			detectedAVs = append(detectedAVs, avName)
-			_, _ = fmt.Fprintf(&output, "✓ 检测到 %s:\n", avName)
-
-			common.LogSuccess(i18n.Tr("avdetect_found", avName, len(foundProcesses)))
-
-			// 输出详细进程信息到控制台
-			for _, proc := range foundProcesses {
-				_, _ = fmt.Fprintf(&output, "  - %s\n", proc)
-				common.LogInfo(i18n.Tr("avdetect_process", proc))
-			}
-			output.WriteString("\n")
-		}
-	}
-
-	// 统计结果
-	output.WriteString("=== 检测结果 ===\n")
-	_, _ = fmt.Fprintf(&output, "检测到的AV产品: %d个\n", len(detectedAVs))
-
-	if len(detectedAVs) > 0 {
-		output.WriteString("检测到的产品: " + strings.Join(detectedAVs, ", ") + "\n")
-	} else {
-		output.WriteString("未检测到已知的AV/EDR产品\n")
-	}
-
-	return &plugins.Result{
-		Success: len(detectedAVs) > 0,
-		Output:  output.String(),
-		Error:   nil,
-	}
-}
-
-// getRunningProcesses 获取运行进程列表 - 跨平台适配
-func (p *AVDetectPlugin) getRunningProcesses() []string {
-	var processes []string
-
-	switch runtime.GOOS {
-	case "windows":
-		processes = p.getWindowsProcesses()
-	case "linux", "darwin":
-		processes = p.getUnixProcesses()
-	default:
-		// 不支持的平台，返回空列表
-		return processes
-	}
-
-	return processes
-}
-
-// getWindowsProcesses 获取Windows进程 - 包含PID和进程名
-func (p *AVDetectPlugin) getWindowsProcesses() []string {
-	var processes []string
-
-	// 使用tasklist命令
-	cmd := exec.Command("tasklist", "/fo", "csv", "/nh")
-	output, err := cmd.Output()
-	if err != nil {
-		return processes
-	}
-
-	lines := strings.Split(string(output), "\n")
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-		if line == "" {
-			continue
-		}
-
-		// 解析CSV格式：进程名,PID,会话名,会话号,内存
-		if strings.HasPrefix(line, "\"") {
-			parts := strings.Split(line, "\",\"")
-			if len(parts) >= 2 {
-				processName := strings.Trim(parts[0], "\"")
-				pid := strings.Trim(parts[1], "\"")
-				if processName != "" && pid != "" {
-					// 格式：进程名 (PID: xxxx)
-					processInfo := fmt.Sprintf("%s (PID: %s)", processName, pid)
-					processes = append(processes, processInfo)
-				}
-			}
-		}
-	}
-
-	return processes
-}
-
-// getUnixProcesses 获取Unix进程 - 简化实现
-func (p *AVDetectPlugin) getUnixProcesses() []string {
-	var processes []string
-
-	// 使用ps命令
-	cmd := exec.Command("ps", "-eo", "comm")
-	output, err := cmd.Output()
-	if err != nil {
-		return processes
-	}
-
-	lines := strings.Split(string(output), "\n")
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-		if line != "" && line != "COMMAND" {
-			processes = append(processes, line)
-		}
-	}
-
-	return processes
-}
-
-// 注册插件
-func init() {
-	RegisterLocalPlugin("avdetect", func() Plugin {
-		return NewAVDetectPlugin()
-	})
-}

plugins/local/systeminfo.go

@@ -4,6 +4,8 @@ package local
 
 import (
 	"context"
+	_ "embed"
+	"encoding/json"
 	"fmt"
 	"net"
 	"os"
@@ -17,6 +19,14 @@ import (
 	"github.com/shadow1ng/fscan/plugins"
 )
 
+//go:embed auto.json
+var avDatabase []byte
+
+type avProduct struct {
+	Processes []string `json:"processes"`
+	URL       string   `json:"url"`
+}
+
 type SystemInfoPlugin struct {
 	plugins.BasePlugin
 	output strings.Builder
@@ -47,6 +57,7 @@ func (p *SystemInfoPlugin) Scan(ctx context.Context, info *common.HostInfo, sess
 	p.collectNetworkInfo()
 	p.collectPrivilegeInfo()
 	p.collectPlatformInfo()
+	p.collectAVInfo()
 	p.collectSensitiveEnvVars()
 
 	return &plugins.Result{
@@ -145,7 +156,6 @@ func (p *SystemInfoPlugin) collectWindowsInfo() {
 		}
 	}
 
-	// 防火墙状态
 	if out, err := p.runCommand("netsh", "advfirewall", "show", "allprofiles", "state"); err == nil {
 		for _, line := range strings.Split(out, "\n") {
 			line = strings.TrimSpace(line)
@@ -155,7 +165,6 @@ func (p *SystemInfoPlugin) collectWindowsInfo() {
 		}
 	}
 
-	// 已安装补丁
 	if out, err := p.runCommand("wmic", "qfe", "get", "HotFixID,InstalledOn"); err == nil {
 		lines := strings.Split(strings.TrimSpace(out), "\n")
 		patches := 0
@@ -168,16 +177,6 @@ func (p *SystemInfoPlugin) collectWindowsInfo() {
 			p.log("systeminfo_patches", patches)
 		}
 	}
-
-	// 已安装的杀软 (WMI)
-	if out, err := p.runCommand("wmic", "/namespace:\\\\root\\SecurityCenter2", "path", "AntiVirusProduct", "get", "displayName"); err == nil {
-		for _, line := range strings.Split(out, "\n") {
-			line = strings.TrimSpace(line)
-			if line != "" && line != "displayName" {
-				p.logSuccess("systeminfo_antivirus", line)
-			}
-		}
-	}
 }
 
 func (p *SystemInfoPlugin) collectLinuxInfo() {
@@ -194,7 +193,6 @@ func (p *SystemInfoPlugin) collectLinuxInfo() {
 		}
 	}
 
-	// 防火墙
 	if out, err := p.runCommand("iptables", "-L", "-n", "--line-numbers"); err == nil {
 		ruleCount := 0
 		for _, line := range strings.Split(out, "\n") {
@@ -205,7 +203,6 @@ func (p *SystemInfoPlugin) collectLinuxInfo() {
 		p.log("systeminfo_firewall_rules", ruleCount)
 	}
 
-	// sudo 权限
 	if out, err := p.runCommand("sudo", "-l", "-n"); err == nil {
 		if strings.Contains(out, "ALL") {
 			p.logSuccess("systeminfo_sudo", "ALL commands")
@@ -229,6 +226,92 @@ func (p *SystemInfoPlugin) collectDarwinInfo() {
 	}
 }
 
+func (p *SystemInfoPlugin) collectAVInfo() {
+	var avProducts map[string]avProduct
+	if err := json.Unmarshal(avDatabase, &avProducts); err != nil {
+		return
+	}
+
+	processes := p.getRunningProcesses()
+	if len(processes) == 0 {
+		return
+	}
+
+	// 建立进程名索引，O(1) 查找
+	processIndex := make(map[string][]string)
+	for _, proc := range processes {
+		name := proc
+		if idx := strings.Index(proc, " (PID: "); idx != -1 {
+			name = proc[:idx]
+		}
+		key := strings.ToLower(name)
+		processIndex[key] = append(processIndex[key], proc)
+	}
+
+	for avName, av := range avProducts {
+		var matched []string
+		for _, avProc := range av.Processes {
+			if procs, ok := processIndex[strings.ToLower(avProc)]; ok {
+				matched = append(matched, procs...)
+			}
+		}
+		if len(matched) > 0 {
+			p.logSuccess("systeminfo_antivirus", fmt.Sprintf("%s (%d个进程)", avName, len(matched)))
+			for _, proc := range matched {
+				p.log("systeminfo_av_process", proc)
+			}
+		}
+	}
+}
+
+func (p *SystemInfoPlugin) getRunningProcesses() []string {
+	switch runtime.GOOS {
+	case "windows":
+		return p.getWindowsProcesses()
+	case "linux", "darwin":
+		return p.getUnixProcesses()
+	}
+	return nil
+}
+
+func (p *SystemInfoPlugin) getWindowsProcesses() []string {
+	out, err := p.runCommand("tasklist", "/fo", "csv", "/nh")
+	if err != nil {
+		return nil
+	}
+	var processes []string
+	for _, line := range strings.Split(string(out), "\n") {
+		line = strings.TrimSpace(line)
+		if !strings.HasPrefix(line, "\"") {
+			continue
+		}
+		parts := strings.Split(line, "\",\"")
+		if len(parts) >= 2 {
+			name := strings.Trim(parts[0], "\"")
+			pid := strings.Trim(parts[1], "\"")
+			if name != "" && pid != "" {
+				processes = append(processes, fmt.Sprintf("%s (PID: %s)", name, pid))
+			}
+		}
+	}
+	return processes
+}
+
+func (p *SystemInfoPlugin) getUnixProcesses() []string {
+	out, err := p.runCommand("ps", "-eo", "comm")
+	if err != nil {
+		return nil
+	}
+	var processes []string
+	for _, line := range strings.Split(string(out), "\n") {
+		line = strings.TrimSpace(line)
+		if line != "" && line != "COMMAND" {
+			processes = append(processes, line)
+		}
+	}
+	return processes
+}
+
 func (p *SystemInfoPlugin) collectSensitiveEnvVars() {
 	keywords := []string{
 		"password", "passwd", "secret", "key", "token",

web/api/config.go

@@ -114,7 +114,6 @@ var plugins = []PluginInfo{
 	{Name: "poc", Type: "web", Description: "POC漏洞检测", DescEn: "POC vulnerability detection", Enabled: true},
 
 	// 本地类
-	{Name: "avdetect", Type: "local", Description: "杀软检测", DescEn: "Antivirus detection", Enabled: false},
 	{Name: "cleaner", Type: "local", Description: "痕迹清理", DescEn: "Trace cleaning", Enabled: false},
 }