C:\Program Files\Steam\user32.dll detected as a trojan by Windows Defender

[xd0v3rdoz3]

Yeah, you read the title.

user32.dll is detected as a trojan by Windows Defender.

[Caduryn]

Guess whats funny?

There is no user32.dll inside Steam Folder

[TWPanda77]

Steam is in c:\Program Files (x86) on my system and there is not user32.dll in there either.

[ShelLuser]

Valve can't fix imaginary problems.

[magicISO Sweden]

classic bait post or award hunting

[Ema Gamer]

I just had that problem too. Do you use any skins program for Steam?

[taimen-maru]

Same thing

[✪ Miscreation ⚥ ☯ 🎭]

Originalmente postado por xd0v3rdoz3:

Yeah, you read the title.

user32.dll is detected as a trojan by Windows Defender.
Please fix this, Valve.

Not being a Steam related file, you CAN just delete it (or force remove it if necessary).

[taimen-maru]

Hmm, in my case user32.dll comes with millennium.

[Ben Lubar]

Sounds like you have a virus, OP. There shouldn't be files with the same names as Windows system files in Steam's folder unless a different program put them there.

[xd0v3rdoz3]

Originalmente postado por Ema Gamer:

I just had that problem too. Do you use any skins program for Steam?

I use Millennium which broke recently and didn't work. Now it works perfectly for me.

[Ferox_Stormdragon]

there is only 1 legit user32.dll file and that's in c:\windows\system32 any other instance of that file is a virus

[aiusepsi]

Apparently Millennium does[github.com] call its DLL user32.dll, but I can see why people would be concerned, using the same name as a well-known system DLL is a sketchy thing to do.

On top of the sketchy name, injecting into another process to modify it is also fairly sketchy behaviour in general (although in this case it is obviously the point of the thing) so I can see why it might get flagged by antivirus.

[Doctor Zalgo]

Originalmente postado por Alice Liddell:

Millennium's core file is named user32.dll to trick Steam into loading it instead of the actual user32.dll shipped by windows, therefore forcing Steam to load Millennium, instead of the Windows USER32. This method allows Millennium to run and safely modify Steam's appearance without altering any of its files or interfering with its process memory.

I can't imagine why the antivirus thinks that's sketchy.