Question malware detected other software

[harlan4096]

Hum I don't think that happened, such a level of system modifications would have triggered K. System Watcher module.

[carlos88]

It's already been removed. My concern is whether this malware AppData\Roaming\secure\QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml) detected by Microsoft Defender corrupted, deleted, or modified my personal files, especially the compressed ones. Before testing with Defender, I used Kaspersky Free as my main antivirus, but I also scanned with Malwarebytes Free and Adwcleaner, and according to all of them, the system was clean and without anything. I downloaded a lot of games, ISOs, emulators, and programs, totaling 250GB, and copied them to an external hard drive. Only after that did I switch from Kaspersky Free to Defender because Kaspersky Free was no longer free. In the first full scan of Microsoft Defender, this malware was found. So, after cleaning, will I have to download everything again to ensure they are intact and copy everything again to the four external hard drives? On VirusTotal, this same malware found by Defender has several different names for different antiviruses. It's hard to tell what it actually is, but I posted the test results at the beginning of the thread, along with a screenshot of the folder where it's located.

Because they said Kaspersky was one of the best antiviruses, I thought this also applied to the free version, but I think it's only the paid version. I used the free version for years, and from what I see in the file folder, it's been on my PC since 2024.

[harlan4096]

As I already told You, that file probably was inactive as a leftover... also, no antivirus firm is 100% even "being the best av"...

[AlexeyK]

35 минут назад, carlos88 сказал:

And Kaspersky Free real-time protection didn't do anything because it didn't have a signature when I updated and started the full scan?

Real-time protection and full scanning are different processes. Yes, it didn't have a malware file signature.

You may install Kaspersky Free again, update the databases, and perform a full scan. If it finds nothing - you don't need anything else. Perhaps this file wasn't used at all, but only laid quietly in the folder.

35 минут назад, carlos88 сказал:

All of my personal files on these PCs and copied to an external hard drive were altered by this malware and need to be redownloaded?

Most likely, everything is fine with files. If there are documents, photos, archives, etc. - just open some number of them and check.

Edited 2 hours ago by AlexeyK

[Berny]

Also and in addition to @harlan4096 , a DLL is not directly running unless it’s solicited.

[carlos88]

When I used Kaspersky Free, there was no signature for the file AppData\Roaming\secure\QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml) in the Kaspersky database. They use a different name.

Without a signature, what would real-time protection do if this file was active and damaging the PC? The full scan didn't detect anything.

I thought if the scan didn't detect anything, then real-time protection was letting the malware pass through and modify the file system.

In my case, what could have happened? The Malwarebytes scan also didn't detect anything.

[Berny]

@carlos88

For privacy reasons we don’t request system logs but without detection from Kaspersky your system is clean.

[AlexeyK]

10 минут назад, carlos88 сказал:

In my case, what could have happened?

It seems to me that in your case could happened too much anxiety. 🙂

[harlan4096]

28 minutes ago, carlos88 said:

When I used Kaspersky Free, there was no signature for the file AppData\Roaming\secure\QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml) in the Kaspersky database. They use a different name.

Without a signature, what would real-time protection do if this file was active and damaging the PC? The full scan didn't detect anything.

I thought if the scan didn't detect anything, then real-time protection was letting the malware pass through and modify the file system.

In my case, what could have happened? The Malwarebytes scan also didn't detect anything.

You said in Your 1st post, the file was detected in a full scan (on demand scan) of Defender, but not in real-time, so that file clearly was inactive in that folder, as already told, probably a leftover or remnant of a previous detection.

[carlos88]

I just uninstalled Kaspersky Free and activated Defender, and there was no alert message. But after I started a full scan with Defender, it found this file.

When I used Kaspersky Free, it didn't issue any alerts about this file, and it didn't appear as malware in the full scan.