Windows Defender quarantined a file named `C:UsersjktraDownloadsSolstice.dll` and identified it as `Trojan:Win32/Ulthar.A!ml`, with a warning that it can execute commands from an attacker. I don't remember downloading it or visiting an obviously unsafe site, although I recently clicked a link from someone who offered a Minecraft mod or add-on. The message was nearly two weeks old, so I'm unsure why the file appeared only now. I don't play Minecraft Bedrock and want to know whether this could be a false positive, a launcher or server asset, or a sign of malware activity.
3 Answers
Don’t assume it’s a false positive just because you were gaming or making a presentation when the alert appeared. The activity that created the file could have happened earlier, or another application could have written it in the background. Let Defender finish quarantine, update its definitions, and get a second-opinion scan from a reputable security tool. If detections continue or unknown programs and accounts appear, disconnect the computer from the network and investigate further.
That DLL doesn’t sound like a normal Minecraft or Windows component, especially if you don’t use the Bedrock edition. A webpage can sometimes trigger a download through a browser action, a script, or a bundled installer, and the antivirus may only alert when the file is scanned or its signature is updated. Review your browser’s download history and the link’s destination, then remove the file and scan the system. If you opened any installer or entered passwords after visiting the link, change those passwords from a clean device and enable two-factor authentication.
A file appearing in Downloads usually means something on the computer created or saved it, even if there was no obvious browser prompt. The detection name is a serious warning, and the fact that Defender noticed it later doesn’t prove it was created recently—it may have been sitting there undetected. Keep it quarantined, don’t restore or open it, and run a full Defender scan followed by an offline scan. Also check browser downloads, installed programs, scheduled tasks, and recent file activity for anything unfamiliar.
I did click a link from someone offering a Minecraft mod, but I didn’t intentionally download anything. The message was about twelve days old, which is why I was confused about the timing.