Kaspersky flagging

[zelhx]

Is it normal that kaspersky flags the app: Action needed: Kaspersky flagged build\release\app.exe as "VHO:Trojan.Win32.Convagent.gen" and now blocks it from running. It's the same kind of false alarm on an unsigned new build as on 2026-10-17, and I didn't touch the alert. To use rapp again, restore the file from quarantine or add a Kaspersky exclusion for the build folder, and report the false positive to Kaspersky. Meanwhile I ran the save check through app server, which saves the same way._

[Dragolone]

Yes, that's a pretty common false positive, and it isn't REA itself being flagged. build\release\app.exe is your own project's build output. REA (I've sent a few fixes upstream) ships as the rea-agents npm package and never produces or installs an app.exe.

The .gen suffix means a generic/heuristic verdict, not a match against a known malware sample. Freshly compiled, unsigned executables that nobody else has run yet trip these a lot, and because every rebuild has a new hash, it can come back after each build.

What I'd do:

1. Sanity-check first: look up the exe's SHA-256 (or upload it) on VirusTotal. If only Kaspersky and maybe one or two other heuristic engines flag it, it's almost certainly a false positive. If many engines agree, check what went into the build before trusting it.
2. Add a Kaspersky exclusion for the build output folder only (build\release\), not the whole project or drive.
3. Report the false positive to Kaspersky through https://opentip.kaspersky.com so they can re-review the verdict.
4. If you plan to distribute the exe, code-sign it. Signed binaries get flagged far less often than unsigned ones.

[Dragolone]

Hope that helps:)