mmurphy

Thank you again Rich.

Like Gosabgo, I had a red circle with a white X icon in front of the file name before it was deleted apparently by MWB. I did not want to restore the version referred to in the first post because I don't have any idea of its safety. Instead I looked on my daughter's computer for the file and found it. It had all the date, etc. data the same as the file I lost. However it also had a red circle with white X icon in front of the name. So now I'm unsure whether to put it on my computer or not. She has not had any virus issues. I went looking on the web for "red circle with white X" and found a number of references to that icon showing up in the task bar of people with an obvious fake alert infection. So now I don't know what to think about the status of DFDWiz.exe. Could MWB be putting the icon in front of the file name?

Thanks to Rich for the very quick reply and the location of the missing file.

Yesterday, 5/17/12 I ran PCTools which is my primary antivirus using a quick scan and a full scan. Found nothing. I updated MWB with the most current database and thenI followed up with a full scan by Malwarebytes, and it identified DFDwiz.exe as Trojan Fake Alert. Foolishly I told MWB to quarantine it. Now I have learned that it was a false positive, but I am now missing DFDwiz.exe. It shows in the MWB quarantine log as quarantined, and I tried multiple times to restore it but nothing happened. I went to the folder where it is supposed to be and the folder is completely empty. Does anyone have a suggestion about getting a copy of DFDwiz.exe or of how to restore the file that got quarantined? The file I had was last modified 7/13/09 and was 77.5kb. File version was 6.1.7600.16385. The log message I got from MWB was: C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. My computer in all other respects is running perfectly - no difference from before yesterday. No signs of virus activity. I am concerned that my registry was altered by MWB as well, but I have no specific basis for that concern.