Solved Question malware found

[Parkinsond]

Or use the Reset this PC option, no need to reinstall, just a freshly Windows when finished

"Reset" does not wipe EFI system partition which may harbor rootkits.

 

[classicaran]

I discovered why the Caller.zip or rar was disappearing from the folder where the Caller.exe file is located. Microsoft Defender is quarantining it, accusing it of Trojan:Script/Wacatac.B!ml.
But the exe file remains in the folder and is not quarantined. It's very strange.
i send Caller.zip for Kaspersky specialist answer is clean file

DLL removed by Microsoft Defender:

VirusTotal

VirusTotal

www.virustotal.com

Caller.exe:

VirusTotal

VirusTotal

www.virustotal.com

folder files:

 

[likeastar20]

I discovered why the Caller.zip or rar was disappearing from the folder where the Caller.exe file is located. Microsoft Defender is quarantining it, accusing it of Trojan:Script/Wacatac.B!ml.
But the exe file remains in the folder and is not quarantined. It's very strange.
i send Caller.zip for Kaspersky specialist answer is clean file

DLL removed by Microsoft Defender:

VirusTotal

VirusTotal

www.virustotal.com

Caller.exe:

VirusTotal

VirusTotal

www.virustotal.com

folder files:

The Caller.exe file is not malicious, only the DLL file is. The DLL file loads when you run the EXE file.

https://www.trellix.com/blogs/research/how-attackers-repackaged-a-threat-into-something-that-looked-benign/

 

[classicaran]

The DLL depends on an EXE to be malicious. The Caller was the .EXE and the DLL was the active malware? And why did my Kaspersky Free never detect this DLL when I used a complete scan? Only Defender detected it in the scan. These two files are in the same folder.

 

[harlan4096]

We don't know if there was a different exe, as You removed KF and its logs... that The Caller exe is not necessary the exe that triggers the dll...

 

[Trident]

I unplug the ethernet cable before re-install: two hits: no updates, and bypass asking for using MS email account.

Yeah but then you still need to install the updates at a later stage.

 

[Parkinsond]

Yeah but then you still need to install the updates at a later stage.

When it is convenient for me, not for MS.

 

[Trident]

When it is convenient for me, not for MS.

It’s annoying regardless when it happens

 

[Parkinsond]

It’s annoying regardless when it happens

Just fear of breaking something; I have plenty of time.

 

[classicaran]

Was the detection of QtWebKit4.dll Malware (Trojan:Win32/Wacatac.C!ml) by Kaspersky Free and Malwarebytes Free recently added? Is this a new malware?

If any free antivirus doesn't detect a Trojan in its scan because it lacks a signature (malware database), is real-time protection also affected, failing to detect and block it?

 

[RoboMan]

Was the detection of QtWebKit4.dll Malware (Trojan:Win32/Wacatac.C!ml) by Kaspersky Free and Malwarebytes Free recently added? Is this a new malware?

If any free antivirus doesn't detect a Trojan in its scan because it lacks a signature (malware database), is real-time protection also affected, failing to detect and block it?

Static (signature) and dynamic (post-execution) are two separate things. Even if an antivirus doesn't have a signature for a specific file, the antivirus' behaviour blocker or another module can intercept and block/delete the malware, and possibly revert its actions. For example, it can fail to delete it at first due to the lack of the signature in their database, but it can analyze the program's behaviour after executed and realise its malware.

So, all in all, it can fail at first and protect you at last.

 

[stonjean633]

Was the detection of QtWebKit4.dll Malware (Trojan:Win32/Wacatac.C!ml) by Kaspersky Free and Malwarebytes Free recently added? Is this a new malware?

If any free antivirus doesn't detect a Trojan in its scan because it lacks a signature (malware database), is real-time protection also affected, failing to detect and block it?

High chance this should be detected by Generic Detection of Kaspersky if no Folder Exclusions was done. But in your case, likely it was excluded. If it was not excluded, the Generic Detection should tag this and the file uploaded to KSN for further analysis either by automation or analyst. After that a proper name will be given or will be remove on detection.

This was only uploaded and further analyzed by Opentip on Oct 9,2025.
There were only 10 hits that it was so low to be considered for a Virus Outbreak.

 

[classicaran]

So even if Kaspersky Free doesn't detect this malware in the scan, can it block and remove it in real-time protection? Does this malware have a triggering behavior?

Why didn't Malwarebytes Free detect it in the standard scan? Is this malware new?

 

[Kongo]

 

[lokamoka820]

So even if Kaspersky Free doesn't detect this malware in the scan, can it block and remove it in real-time protection? Does this malware have a triggering behavior?

Why didn't Malwarebytes Free detect it in the standard scan? Is this malware new?

You can read the following thread carefully with focus, it will help you

Solved Thread 'Question malware found'

Oct 8, 2025

I ran a full scan with Microsoft Defender on my PC and it found the file AppData\Roaming\secure\QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml).

But before using Defender, I had run a full scan with Malwarebytes Free and Kaspersky Free and found nothing. Why did it detect this now?

Is this type of malware the kind that modifies, deletes, or corrupts files on the PC?

• classicaran
• Replies: 302
• Forum: General Security Discussions

• 
• 

 

[classicaran]

What are the names of types of malware that acess, modify, delete, or corrupt PC hdd and ssd files (Windows files and personal files, games, music, executables, ISO, IMG, RAR, ZIP, 7Z)? Does all malware have the potential to do this?

In this case, how are the malware QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml), Caller.exe (DrWeb detects
Trojan.DownLoader47.36298), and Caller.exe (VBA32 detects
TrojanPSW.Rhadamanthys) classified?

Caller.exe is related with QtWebKit4.dll? in same folder

 

[lokamoka820]

What are the names of types of malware that acess, modify, delete, or corrupt PC hdd and ssd files (Windows files and personal files, games, music, executables, ISO, IMG, RAR, ZIP, 7Z)? Does all malware have the potential to do this?

Ransomware is the type of malware that can access, modify, delete, or damage files on your computer, which is not the case with malware on your computer.

 

[Jonny Quest]

If you all want to keep answering any future posts by classicaran, that's up to you, but IMO (FWIW) this thread should probably be closed as well.
Thank you for trying @icotonev

Post in thread '[Closed] Question FRST64 logs'

Oct 19, 2025

Sorry, you are looking for help in other forums..! This is extremely disrespectful..! This topic closes..!

Question malware found in file - Page 2 - Virus, Trojan, Spyware, and Malware Removal Help

Page 2 of 2 - Question malware found in file - posted in Virus, Trojan, Spyware, and Malware Removal Help: Please read and reply to what I posted in Post #13.

www.bleepingcomputer.com

Question files malware detected by defender - Microsoft Q&A

I used to use Kaspersky Free and Malwarebytes Free, but they never detected these files as malicious in their scans. Now I use Microsoft Defender. In the first full scan, it detected this file: AppData\Roaming\Secure\QtWebKit4.dll…

learn.microsoft.com

Question malware found

I ran a full scan with Microsoft Defender on my PC and it found the unique file AppData\Roaming\secure\QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml). But before using Defender, I had run a full scan with Malwarebytes Free and Kaspersky Free and found nothing. Why did it detect this now? Is this type ...

forum.eset.com

Detection malware question

I ran a full scan with Microsoft Defender on my PC and it found the unique file AppData\Roaming\secure\QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml). But before using Defender, I had run a full scan with Malwarebytes Free and Kaspersky Free and found nothing. Why did it detect this now? Is this...

community.spiceworks.com

• icotonev

• 

 

[stonjean633]

Oh man! Multiple threads here and other forums for the same issue

 

[classicaran]

Thank you, friends, for sharing your malware experience. I'm learning a lot about this security world.

Trojans and viruses are the same thing?

only malware type ransomware is capable of modifying, deleting, or corrupting any type of file on my PC?

The only malware found for me was QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml), Caller.exe (detects
Trojan.DownLoader47.36298), and Caller.exe (
TrojanPSW.Rhadamanthys), Trojan.Win32.Agent.xcajyl, Application.Fragtor.Generic