文档：补充杀毒软件误报处理指南

docs/.vitepress/config.mts

@@ -15,6 +15,7 @@ const guide: Page[] = [
   ['/guide/upgrade', '升级', 'Upgrade'],
   ['/guide/changes', '和官方模拟器有什么不同', 'How ModAVD differs from the official emulator'],
   ['/guide/feedback', '反馈问题', 'Report a problem'],
+  ['/guide/false-positive', '杀毒软件误报怎么办', 'What to do when antivirus software flags ModAVD'],
   ['/guide/privacy', '隐私', 'Privacy'],
   ['/guide/license', '许可证与源码', 'Licenses and source code'],
 ]

docs/en/guide/false-positive.md

@@ -0,0 +1,51 @@
+# What to do when antivirus software flags ModAVD
+
+Antivirus software can occasionally report a ModAVD file as a trojan. Use the steps below to verify where the file came from and that it is intact before you decide whether to allow it.
+
+## Why this happens
+
+ModAVD programs do not have commercial code signing. Machine-learning rules in some antivirus products can occasionally classify an unsigned program as a trojan. Windows Defender and Kaspersky have both produced this kind of false positive.
+
+## Verify that the download is genuine
+
+1. ModAVD is distributed through two channels only: the [ModAVD Releases](https://github.com/ModAVD/ModAVD/releases) page on GitHub and MirrorChyan. Download the archive from one of them. The checksum list to check against is always `SHA256SUMS.txt` on the GitHub release page; use it for a download from MirrorChyan too.
+2. Open PowerShell in the folder where you saved the archive and run the following command, replacing the file name with the one you downloaded:
+
+   ```powershell
+   Get-FileHash .\ModAVD-<version>-win-x64.zip -Algorithm SHA256
+   ```
+
+3. Compare the `Hash` in the command output with the hash for that file in `SHA256SUMS.txt`. `Get-FileHash` prints uppercase letters while `SHA256SUMS.txt` uses lowercase, so ignore case when you compare; every character must otherwise be the same. Continue only when they match. If they do not, delete the archive and download it again from the GitHub release page.
+
+## Allowing a file in Windows Defender
+
+### Restore a quarantined file
+
+1. Open Windows Security → **Virus & threat protection** → **Protection history**.
+2. Find the entry for ModAVD. Open its details and confirm that the path and file name belong to the release archive you just verified.
+3. Choose **Actions** → **Allow on device** or **Restore**, then follow the prompts.
+
+### Add an exclusion
+
+1. Open Windows Security → **Virus & threat protection** → **Manage settings** → **Exclusions** → **Add or remove exclusions**.
+2. Choose **Add an exclusion** → **Folder**, then select the extracted ModAVD root folder.
+3. Save the setting and run ModAVD again.
+
+Add an exclusion only for the ModAVD root folder. Do not exclude an entire drive or your whole user profile.
+
+## Add a trusted item in Kaspersky
+
+1. Open Kaspersky and go to **Settings** → **Security settings** → **Threats and Exclusions** → **Manage exclusions**. The menu names can vary slightly between product versions.
+2. Click **Add** and select the extracted ModAVD root folder.
+3. Confirm that files in this folder are trusted or excluded from scanning, then save the setting and run ModAVD again.
+
+Add only the ModAVD root folder. Do not trust an entire drive.
+
+## Report a false positive
+
+Open an issue in the [ModAVD repository](https://github.com/ModAVD/ModAVD/issues) and include:
+
+- the antivirus product and version;
+- the detection name (for example, the reported trojan name);
+- the blocked file name and the release version;
+- if possible, the `SHA256SUMS.txt` result and a screenshot of the detection.

docs/guide/false-positive.md

@@ -0,0 +1,51 @@
+# 杀毒软件误报怎么办
+
+偶尔会有杀毒软件把 ModAVD 的文件报成木马。可以先按下面的步骤确认文件来源和完整性，再决定是否放行。
+
+## 为什么会误报
+
+ModAVD 的程序没有商业代码签名。个别杀毒软件的机器学习规则会偶尔把没有这类签名的程序判成木马，Windows Defender、Kaspersky 都出现过这种误报。
+
+## 先确认下载的是正版
+
+1. ModAVD 只通过两个渠道分发：GitHub 上的 [ModAVD Releases](https://github.com/ModAVD/ModAVD/releases) 发布页和 Mirror 酱。压缩包从这两处下载。核对用的哈希清单统一以 GitHub 发布页上的 `SHA256SUMS.txt` 为准，从 Mirror 酱下载的也拿它核对。
+2. 在保存压缩包的文件夹里打开 PowerShell，运行下面的命令，把文件名换成实际下载的文件名：
+
+   ```powershell
+   Get-FileHash .\ModAVD-<版本>-win-x64.zip -Algorithm SHA256
+   ```
+
+3. 把命令输出的 `Hash` 和 `SHA256SUMS.txt` 里对应文件的哈希对照。`Get-FileHash` 输出的是大写字母，`SHA256SUMS.txt` 里是小写，比对时不分大小写，其余每一位都要相同。一致才继续解压和使用；不一致就删除压缩包，重新从 GitHub 发布页下载。
+
+## Windows Defender 怎么放行
+
+### 恢复被隔离的文件
+
+1. 打开「Windows 安全中心」→「病毒和威胁防护」→「保护历史记录」。
+2. 找到报告 ModAVD 的记录，打开详情，确认路径和文件名属于你刚才核对过的发布包。
+3. 选择「操作」→「在设备上允许」或「恢复」，按提示完成。
+
+### 加排除项
+
+1. 打开「Windows 安全中心」→「病毒和威胁防护」→「管理设置」→「排除项」→「添加或删除排除项」。
+2. 选择「添加排除项」→「文件夹」，选中解压后的 ModAVD 根目录。
+3. 保存设置后再运行 ModAVD。
+
+排除项只加 ModAVD 根目录，不要把整块磁盘或整个用户目录加入排除项。
+
+## Kaspersky 怎么加信任
+
+1. 打开 Kaspersky，进入「设置」→「安全设置」→「威胁和排除项」→「管理排除项」（不同产品版本的菜单名称可能略有不同）。
+2. 点击「添加」，选择解压后的 ModAVD 根目录。
+3. 确认对这个文件夹启用信任或不扫描其中的文件，保存设置后再运行 ModAVD。
+
+同样只添加 ModAVD 根目录，不要放行整块磁盘。
+
+## 仍然被误报时怎么反馈
+
+到 [ModAVD 仓库的 Issues](https://github.com/ModAVD/ModAVD/issues) 提交问题，并写明：
+
+- 杀毒软件名称和版本；
+- 检测到的名称（例如木马名称）；
+- 被拦截的文件名，以及对应发布版本；
+- 如果方便，附上 `SHA256SUMS.txt` 的核对结果和检测截图。