fix(malware): remove hardcoded signatures to prevent AV false positives

[dbfx]

Summary

• Removes 188 hardcoded malware signature regex patterns and hash lookups from the binary that were triggering Avira EXP/YAV.Minerva false positives
• Removes build-time YARA rule bundling (prefetch:rules, extraResources) — rules are now downloaded from the cloud on first launch instead of shipped in the installer
• Reduces initial cloud rule check delay from 30s to 5s so signatures are available quickly after first install

Why

AV heuristic engines (Avira confirmed, likely others) scan our binary and see malware name strings like XMRig, CobaltStrike, Emotet, WannaCry etc. baked into the code. They flag the app as containing exploit patterns rather than recognizing it as a tool that detects malware. Moving all signature data to cloud-downloaded YARA rules eliminates these strings from the binary entirely.

What changed

File	Change
malware-scanner.ipc.ts	Removed KNOWN_MALWARE_PATTERNS (188 entries), KNOWN_MALWARE_HASHES, and the regex fallback scan path. Kept SUSPICIOUS_FILENAMES (process name heuristics — won't trigger AV).
yara-rules-store.ts	Removed getBundledRulesDir/getBundledRulePaths, simplified getAllRulePaths() to cloud-only, reduced first check from 30s → 5s
electron-builder.yml	Removed resources/yara-rules from extraResources
package.json	Removed prefetch:rules from all package:* build scripts
shared/types.ts	Updated YaraRulesInfo: removed bundledRules, 'bundled' source, 'regex-fallback' engine; added 'pending' engine state
MalwareScannerPage.tsx	Removed bundled source/count display
locales/*/malware.json	Removed dbSourceBundled, updated dbRuleFilesCounts to cloud-only format
Test files	Removed KNOWN_MALWARE_PATTERNS tests and bundled-vs-cached merge tests

Test plan

• All 1926 tests pass (86 test files)
• Build succeeds (electron-vite build)
• Verify first-launch downloads rules within ~5s and YARA engine compiles
• Verify scan works with cloud rules (signature + heuristic detection)
• Verify scan gracefully handles no rules yet (skips signatures, runs heuristics)
• Submit built binary to Avira/VirusTotal to confirm false positive is resolved

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.