Windows defender false? virus report

[JayDee]

ISSUE
Windows defender reports a trojan in one of the Steam files
Steam\steamui\localization\shared_thai-json.js

Trojan:Script/ObfusScript.A!ml

OS
Windows 11

STEPS
-

EXPECTED
No false error reports.

[Baron Von Boom]

Same issue here

[Some Guy]

Oprindeligt skrevet af Some Guy:

Oprindeligt skrevet af Leachim:

The same here:
Trojan:Script/ObfusScript.A!ml
detected in 2 files:
file: F:\Valve\steamui\localization\shared_koreana-json.js
file: F:\Valve\steamui\localization\shared_thai-json.js

and

Trojan:Win32/Phonzy.B!ml detected in
file: F:\Valve\steamui\localization\shared_vietnamese-json.js

Now two question. What happens if I delete these folders? Are these folders in fact malicious, because only when I start Steam does the threat notification appear?

I suspect that this is a false positive in a new update? They do happen from time to time particularly with games, but in my experience it's never happened with the steam client itself.
If you or your anti virus deletes the files, they'll be reinstalled when steam restarts. My suspicion is that this is a genuine false positive BUT for the time being it might be better to wait and see.

There's also this page on the steam support FQA which explains a bit more in depth:
https://help.steampowered.com/en/faqs/view/5F3D-1477-AFF9-C4F3

Steam Support got back to me - they say it's a false positive. Their reply is below:

---

Hello there,

No worries, I'm glad to provide you information regarding this.

Products shipped on Steam are scanned for viruses before we make them available to download. The issue you are experiencing is most likely due to a false positive with the anti-virus software on your computer.

Anti-virus software commonly uses heuristic or fuzzy matches for virus or malware-like behavior and a side effect of this is that false positives can be common with some anti-virus vendors.

Our recommendation is to contact your anti-virus vendor if you are concerned and want additional clarification on the issue they are detecting. You may need to exclude the folder containing the falsely detected executable from your anti-virus scanning in order to proceed using Steam or installing/playing the impacted product.

Please follow this link for more information.

Steam Support

[Leachim]

Oprindeligt skrevet af Some Guy:

Oprindeligt skrevet af Some Guy:

I suspect that this is a false positive in a new update? They do happen from time to time particularly with games, but in my experience it's never happened with the steam client itself.
If you or your anti virus deletes the files, they'll be reinstalled when steam restarts. My suspicion is that this is a genuine false positive BUT for the time being it might be better to wait and see.

There's also this page on the steam support FQA which explains a bit more in depth:
https://help.steampowered.com/en/faqs/view/5F3D-1477-AFF9-C4F3

Steam Support got back to me - they say it's a false positive. Their reply is below:

---

Hello there,

No worries, I'm glad to provide you information regarding this.

Products shipped on Steam are scanned for viruses before we make them available to download. The issue you are experiencing is most likely due to a false positive with the anti-virus software on your computer.

Anti-virus software commonly uses heuristic or fuzzy matches for virus or malware-like behavior and a side effect of this is that false positives can be common with some anti-virus vendors.

Our recommendation is to contact your anti-virus vendor if you are concerned and want additional clarification on the issue they are detecting. You may need to exclude the folder containing the falsely detected executable from your anti-virus scanning in order to proceed using Steam or installing/playing the impacted product.

Please follow this link for more information.

Steam Support

Thanks man.
But I don't know, a new update came out and after that the problem disappeared. But in the end, it was nothing. Phew!

[lightwo]

Just FYI,

Oprindeligt skrevet af Some Guy:

Products shipped on Steam are scanned for viruses before we make them available to download.

...this is clearly a boilerplate response regarding third party games, not the client.

Regardless, as said in many comments before, Defender has a very big issue with false positives due to improperly detecting character encoding. Taking a brief look into any of the three affected files reveals that it is, indeed, the issue at hand.