Is DepotDownloader.exe a virus?

01What the file actually is

First, let's correct a piece of misinformation that ranks high on this exact search. Several "what is this .exe" sites claim DepotDownloader.exe is a "Valve Corporation Source SDK" file of around 36 MB. That's wrong. DepotDownloader is not a Valve product. It's an open-source command-line tool maintained by SteamRE — the same independent community behind SteamKit2 and adjacent to SteamDB — written in .NET. It does one thing: log into Steam with an account you own and download that account's licensed game files (depots) by their content manifests. There's no installer, no background service, no startup entry; it's a program you run from a terminal and that exits when it's done. If you found DepotDownloader.exe on your machine, it's there because you (or something you ran) unzipped it — it doesn't install itself into Program Files or autostart.

Because it's fully open source, anyone can read exactly what it does — which is the deepest answer to "is it safe," and the one process-info sites can't give you.

02Why antivirus flags it

Windows Defender (or another engine) deleting or quarantining DepotDownloader, often with a generic verdict like Trojan:Win32/Wacatac.B!ml or Program:Win32/Wacapew.C!ml, is the single most common scare around this tool — and it's a textbook false positive. Here's why a legitimate program trips the alarm:

• It's unsigned. Code-signing certificates cost money; most free open-source tools don't have one. Unsigned executables get extra suspicion by default.
• It's a single self-contained file. The standalone build bundles the .NET runtime into one packed .exe — a structure that superficially resembles how some malware is packed, which heuristic/ML engines weight heavily.
• It downloads files and talks to remote servers. Connecting to the internet and writing executable game files to disk is exactly the behavior signature anti-malware models are trained to be nervous about — even when the remote server is Valve and the files are your own games.

The !ml suffix on those verdicts literally means "machine-learning" — a guess from behavior and structure, not a match against a known threat. The tell-tale of a false positive: a detection by only one or two engines (out of ~70) on a build you got from the official source. Real malware lights up dozens.

03Verify it yourself

Don't take anyone's word for it — including mine. Two checks settle it, and they're the same two I run on my own builds:

1. VirusTotal. Upload your DepotDownloader.exe (or paste its hash) to virustotal.com. A clean file shows zero or a small handful of heuristic-only detections from minor engines; the major engines come back clean. That pattern = false positive. (A wall of detections across major engines = you have a tampered or fake copy — delete it and re-download from the official source below.)
2. Match it to the official release. Compare the file you have against the official GitHub release — same file name, same size, ideally same hash. If yours came from a random "download" site and doesn't match, that's the thing to be suspicious of, not the genuine tool.

04Getting the real one

Most "is this safe" worry evaporates if you simply get the tool from where it's actually published, rather than a search-ad download portal or a rehosted .exe. The genuine, official sources:

What to avoid: generic "DepotDownloader download" portals, random mirror sites, and the many same-named forks on GitHub. A fork isn't automatically malicious, but it has no guarantee of being the audited upstream code — and one family of forks (the "Mod" / dump-key variants) deliberately adds the ability to download content you don't own, which carries its own legal and trust problems on top of the higher malware risk of an unreviewed build — see DepotDownloader vs DepotDownloaderMod. If you want the plain, legitimate tool, take it from one of the three rows above. Our own download page points only to these. (This site is an unofficial community hub — the tool's home is SteamRE's GitHub, not here.)

05If Defender already deleted it

If your antivirus quarantined or removed the file, and you've confirmed via VirusTotal and the official source that you have a genuine copy:

1. Restore from quarantine — in Windows Security → Protection history, find the DepotDownloader detection and choose Restore (you may need to allow it).
2. Add an exclusion only for the folder you keep it in, so it isn't re-deleted mid-download. Keep the exclusion narrow (that one folder), not your whole drive.
3. If in any doubt about the copy you had, delete it and re-download fresh from the official release, then re-verify.

One honest caution, and the line I won't blur: an exclusion tells your antivirus to stop watching that folder, so only ever exclude a location holding software you've verified. Don't disable your antivirus wholesale on a stranger's say-so — verify first, exclude narrowly second.

06The bigger safety questions

"Is the .exe a virus" is only one of the worries people bring to this tool. The others have their own answers:

• Will I get VAC-banned / account-banned? No — DepotDownloader downloads your own licensed files and doesn't modify or inject anything; VAC concerns cheating in secured matches, not how files were obtained. The real-world risk is trying to play online on an outdated build. Full reasoning on the safety page.
• Is it safe to enter my Steam password / 2FA? Your password goes only to Steam (via the same SteamKit2 library Steam-adjacent tools use), it's not stored on disk in plain form, anonymous mode needs no login at all for some content, and you can log in by QR instead. The mechanics — and what is written to disk — are documented in authentication and discussed plainly on the safety page.
• Is it legal? It downloads games you own from your own account; ownership is required. The grey area is the "Mod" forks that bypass ownership — a different tool with different ethics, covered alongside the trust discussion.

So: the official DepotDownloader is open-source software that an antivirus occasionally mistakes for malware. Verify the copy you have, get it from SteamRE's GitHub (or winget/brew), and the "is it a virus" question answers itself.