nod32 blocking "steamwebhelper.exe" for

[Dre__ 0]

So NOD32 started blocking the file "steamwebhelper.exe", saying that "hxxp://store.akamai.steamstatic.com/public/shared/fonts/motiva-sans.ttf" it's a threat. That process is part of Steam and multiple instances of that application are always running.

 

Log from nod32:

"2/11/2015 8:20:02 PM    hxxp://store.akamai.steamstatic.com/public/shared/fonts/motiva-sans.ttf   Blocked by internal blacklist   E:\Game Installations\Steam\bin\steamwebhelper.exe    Dre-PC\Dre"

 

VirusTotal shows that nod32 is the only one detecting this as a threat:

https://www.virustotal.com/en/url/e6cb27841699c5507151e06352b2bcc1b65f0b90d556926de8fc2cd40e14be16/analysis/

 

There's also a few other people on the steam forums that are getting this same error.

 

Can I assume this is a false positive?

[Marcos 4,706]

The url shouldn't be blocked at the moment.

[rugk 397]

Yes, this is a font file! If a font file would be malicious then this would be either not a real font file or very strange...

 

And it isn't blocked by ESS or NOD32, so maybe just update your VSD and then it should work.

[Proactive Services 11]

Yes, this is a font file! If a font file would be malicious then this would be either not a real font file or very strange...

 

You'd be surprised how many remote code execution vulnerabilities have been reported to be able to compromise operating systems and software. More than I care to remember!

[rugk 397]

Well... security issues can be there anytime, of course. But how many of these used malicious font files?

[LaiLai 8]

It's a bit old, but still interesting: hxxp://www.iss.net/threats/449.html

[rugk 397]

OK, yeah... security issues are everywhere...

[LaiLai 8]

This .ttf thing reminded me how very long time ago I've encountered threats in .wmv and .gif files for the first time We can't be sure with anything when it comes to threats Gladly we have some good protection software that keeps us safe. Cheers for ESET ^.^