I am also seeing my download speed slowly decline (drops roughly 50% every 2-3 hours after restart). 2019-06-03 22:25:56, Info CSI 00003ccd [SR] Beginning Verify and Repair transaction 2019-06-03 22:13:53, Info CSI 00000e92 [SR] Verifying 100 components 2019-06-03 22:17:00, Info CSI 00001a5c [SR] Beginning Verify and Repair transaction 2019-06-03 22:12:39, Info CSI 00000bee [SR] Verify complete 2019-06-03 22:19:50, Info CSI 0000247a [SR] Beginning Verify and Repair transaction Id suggest that you optimize and maintain your computer. 2019-06-03 22:25:33, Info CSI 00003b24 [SR] Verify complete 2019-06-03 22:17:40, Info CSI 00001c93 [SR] Verifying 100 components Then locate to processes. 2019-06-03 22:10:32, Info CSI 0000054b [SR] Verifying 100 components The issue resolved when I upgraded to Win10 on that machine. 2019-06-03 22:10:26, Info CSI 000004e4 [SR] Beginning Verify and Repair transaction Any forward-looking statement speaks only as of the date as of which such statement is made, and, except as required by law, we undertake no obligation to update any forward-looking statement after the date as of which such statement was made, whether to reflect changes in circumstances or our expectations, the occurrence of unanticipated events, or otherwise. Built on proprietary technologies and world-class threat intelligence, our applications and solutions help prevent, detect, and respond to cyber threats. If no objects are detected, close the AdwCleaner window. Which is still better than constant. 2019-06-03 22:12:20, Info CSI 00000b09 [SR] Beginning Verify and Repair transaction 2019-06-03 22:12:14, Info CSI 00000a9d [SR] Verify complete 2019-06-03 22:28:18, Info CSI 000045ec [SR] Beginning Verify and Repair transaction 2019-06-03 22:21:42, Info CSI 00002ab9 [SR] Beginning Verify and Repair transaction 2019-06-03 22:25:24, Info CSI 00003ab2 [SR] Verify complete 2019-06-03 22:23:52, Info CSI 00003401 [SR] Beginning Verify and Repair transaction 2019-06-03 22:13:07, Info CSI 00000d45 [SR] Verifying 100 components 2019-06-03 22:20:13, Info CSI 000025c4 [SR] Verify complete 2019-06-03 22:18:04, Info CSI 00001db4 [SR] Verifying 100 components 2019-06-03 22:27:14, Info CSI 000041d1 [SR] Verify complete 2019-06-03 22:22:17, Info CSI 00002ce5 [SR] Verifying 100 components 2019-06-03 22:10:51, Info CSI 000006ea [SR] Verifying 100 components Simply put, what the hell is going on? 2019-06-03 22:10:39, Info CSI 0000061c [SR] Beginning Verify and Repair transaction 2019-06-03 22:09:45, Info CSI 00000208 [SR] Verify complete 2019-06-03 22:24:56, Info CSI 0000388b [SR] Verify complete 2019-06-03 22:25:43, Info CSI 00003bf3 [SR] Verifying 100 components Secureworks' Red Cloak TDR software applies a variety of machine and deep learning techniques to a vast network of data, making it easier to find hard-to-detect threats across an entire IT landscape. 2019-06-03 22:22:47, Info CSI 00002eae [SR] Verify complete redcloak.exe is known as Dell SecureWorks Codename Redcloak, it also has the following name Dell SecureWorks Red Cloak or Secureworks Red Cloak and it is developed by Dell SecureWorks.We have seen about 48 different instances of redcloak.exe in different location. 2019-06-03 22:10:07, Info CSI 000003a6 [SR] Verify complete I've spent several weeks trying to figure this out with all sorts of solutions implemented and none having any effect. FirewallRules: [{95F772B1-0AB0-4172-9672-0D8D31ABD905}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd), ==================== Restore Points =========================, ==================== Faulty Device Manager Devices =============, Application Path: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe, Report Id: 009dcebb-d3f7-48fd-a8e8-5fe7f30f0294, Faulting package full name: Microsoft.LockApp_10.0.17763.1_neutral__cw5n1h2txyewy, Faulting package-relative application ID: WindowsDefaultLockScreen, Error: (03/20/2019 08:49:37 AM) (Source: Application Hang) (EventID: 1002) (User: ), Report Id: 9c70a34f-dbb3-42d3-ad67-42ab800351df, Error: (02/27/2019 12:19:59 PM) (Source: Application Hang) (EventID: 1002) (User: ), Report Id: 1da64374-4712-4099-8c90-17633e62d96d, Error: (12/28/2018 08:09:10 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY), Error: (04/02/2019 11:58:10 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), Error: (04/02/2019 11:56:38 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), Error: (04/02/2019 11:56:37 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), Error: (03/20/2019 05:42:52 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), Error: (03/20/2019 05:41:02 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), ==================== Memory info ===========================, ==================== Drives ================================, Drive c: () (Fixed) (Total:930.07 GB) (Free:893.03 GB) NTFS, \\?\Volume{c0eb0321-e386-4eb6-af69-4d63c700a79d}\ (WINRETOOLS) (Fixed) (Total:0.83 GB) (Free:0.44 GB) NTFS, ==================== MBR & Partition Table ==================, ========================================================, ==================== End of Addition.txt ============================, Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotomi.com, ***** [ Chromium (and derivatives) ] *****, ***** [ Firefox (and derivatives) ] *****, AdwCleaner[S00].txt - [3024 octets] - [30/05/2019 22:53:46], ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########. 2019-06-03 22:19:25, Info CSI 000022c7 [SR] Beginning Verify and Repair transaction 2019-06-03 22:19:04, Info CSI 0000212a [SR] Verify complete 2019-06-03 22:14:41, Info CSI 00001185 [SR] Verify complete 2019-06-03 22:25:24, Info CSI 00003ab4 [SR] Beginning Verify and Repair transaction We deploy numerous trip wires looking for threats in many different ways. 2019-06-03 22:15:19, Info CSI 00001417 [SR] Beginning Verify and Repair transaction One method is running services.msc on Windows and stopping the services named 'Dell SecureWorks Ignition' and 'Dell SecureWorks Red Cloak' as depicted below: step 2. 2019-06-03 22:22:57, Info CSI 00002f7f [SR] Beginning Verify and Repair transaction However most often I have only Outlook, WORD, Excel, and IE 11 open at any given time. 2019-05-31 08:59:30, Info CSI 00000017 [SR] Verify complete 2019-06-03 22:18:48, Info CSI 00002046 [SR] Beginning Verify and Repair transaction We've been checking out crowdstrike for their managed solution recently. This may take some time. 2019-06-03 22:11:32, Info CSI 00000820 [SR] Verifying 100 components 2019-06-03 22:27:27, Info CSI 000042a4 [SR] Verifying 100 components 2019-06-03 22:19:38, Info CSI 000023a4 [SR] Verify complete We found the following screenshots in the log files that explained what was happening. Also, please check if there is backup software or antivirus scan which runs on the system when the issue reoccurs. 2019-06-03 22:09:36, Info CSI 0000013b [SR] Verifying 100 components 2019-06-03 22:23:21, Info CSI 00003188 [SR] Beginning Verify and Repair transaction 2019-06-03 22:23:30, Info CSI 00003258 [SR] Beginning Verify and Repair transaction 2019-06-03 22:28:30, Info CSI 000046c0 [SR] Verify complete 2019-06-03 22:20:05, Info CSI 0000255e [SR] Verifying 100 components Therefore, please complete all requested steps to make sure any malware is successfully eradicated from your PC. 2019-06-03 22:24:56, Info CSI 0000388c [SR] Verifying 100 components For more information about specific system requirements, click the appropriate operating system. 2019-06-03 22:20:25, Info CSI 0000266b [SR] Verifying 100 components 2019-06-03 22:20:05, Info CSI 0000255f [SR] Beginning Verify and Repair transaction 2019-06-03 22:14:41, Info CSI 00001187 [SR] Beginning Verify and Repair transaction 2019-06-03 22:18:04, Info CSI 00001db5 [SR] Beginning Verify and Repair transaction 2019-06-03 22:13:17, Info CSI 00000db3 [SR] Verify complete 2019-06-03 22:24:50, Info CSI 00003825 [SR] Verifying 100 components ), HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\90114426.sys => ""="Driver", ==================== Association (Whitelisted) ===============, (If an entry is included in the fixlist, the registry item will be restored to default or removed. 2019-06-03 22:10:07, Info CSI 000003a7 [SR] Verifying 100 components 2019-05-31 08:59:32, Info CSI 0000001e [SR] Verify complete Media State . 2019-06-03 22:18:19, Info CSI 00001e8e [SR] Verify complete 2019-06-03 22:28:30, Info CSI 000046c2 [SR] Beginning Verify and Repair transaction 2019-06-03 22:21:30, Info CSI 000029e1 [SR] Verify complete Can we test the wireless driver? 2019-06-03 22:18:19, Info CSI 00001e90 [SR] Beginning Verify and Repair transaction . 2019-06-03 22:22:35, Info CSI 00002ddf [SR] Verify complete Sometimes it is System Interrupts, MsMpEnge.exe, svchost.exe, dwm.exe, etc. 2019-06-03 22:23:47, Info CSI 0000339a [SR] Beginning Verify and Repair transaction 2019-06-03 22:28:00, Info CSI 000044b5 [SR] Verify complete 2019-06-03 22:28:43, Info CSI 000047cf [SR] Repairing 0 components 2019-06-03 22:16:38, Info CSI 00001902 [SR] Verifying 100 components This is the reason I finally resorted to the reinstallation of Win7. 2019-06-03 22:10:39, Info CSI 0000061a [SR] Verify complete They were mostly good about communication in regards to the fix process, but have seemed to downplay the potential severity of this bug. 2019-06-03 22:26:24, Info CSI 00003ec4 [SR] Verify complete When the scan is finished and if threats have been detected, select, ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. This press release contains forward-looking statements within the meaning of Section 21E of the Securities Exchange Act of 1934 and Section 27A of the Securities Act of 1933 and are based on Secureworks' current expectations. The computer is almost 4 years old but I would hate to spend the $$ to replace it and find that the problem is software. 2019-06-03 22:22:40, Info CSI 00002e46 [SR] Verify complete 2019-06-03 22:15:13, Info CSI 000013ad [SR] Beginning Verify and Repair transaction 2019-06-03 22:09:54, Info CSI 000002d6 [SR] Verify complete 2019-06-03 22:28:18, Info CSI 000045eb [SR] Verifying 100 components . 2019-06-03 22:20:50, Info CSI 000027b8 [SR] Beginning Verify and Repair transaction 2019-06-03 22:26:59, Info CSI 000040eb [SR] Beginning Verify and Repair transaction 2019-06-03 22:15:13, Info CSI 000013ac [SR] Verifying 100 components 2019-06-03 22:26:03, Info CSI 00003d36 [SR] Beginning Verify and Repair transaction . Then push on CPU usage to bring processes to descending to see which apps/processes using the most. 2019-06-03 22:24:18, Info CSI 0000360e [SR] Beginning Verify and Repair transaction 2019-06-03 22:24:18, Info CSI 0000360d [SR] Verifying 100 components 2019-06-03 22:13:53, Info CSI 00000e91 [SR] Verify complete Follow the on-screen instructions to restore your computer to before the settings were modified for the Clean Boot. 2019-06-03 22:21:47, Info CSI 00002b26 [SR] Beginning Verify and Repair transaction Support may be deemed as out of scope for the service at the discretion of Secureworks.364-bit and 32-bit versions are supported. 2019-06-03 22:12:14, Info CSI 00000a9e [SR] Verifying 100 components The problem is explained like this ), (If an entry is included in the fixlist, it will be removed from the registry. 2019-06-03 22:24:38, Info CSI 0000374d [SR] Beginning Verify and Repair transaction 2019-06-03 22:25:03, Info CSI 0000390b [SR] Beginning Verify and Repair transaction 2019-06-03 22:25:20, Info CSI 00003a47 [SR] Beginning Verify and Repair transaction 2019-06-03 22:21:13, Info CSI 00002901 [SR] Verifying 100 components 2019-06-03 22:10:39, Info CSI 0000061b [SR] Verifying 100 components 2019-06-03 22:16:14, Info CSI 00001728 [SR] Beginning Verify and Repair transaction 2019-06-03 22:25:37, Info CSI 00003b8c [SR] Verifying 100 components 2019-06-03 22:24:23, Info CSI 00003676 [SR] Verifying 100 components 2019-06-03 22:17:05, Info CSI 00001ac4 [SR] Verifying 100 components 2019-06-03 22:16:30, Info CSI 0000188c [SR] Verifying 100 components A restart always fixed the problem. Ok thanks for the assistance ;) Here is the first log, ADWcleaner. . Dell Laptops all models Read-only Support Forum. 2019-06-03 22:11:52, Info CSI 00000956 [SR] Verifying 100 components 2019-06-03 22:16:30, Info CSI 0000188d [SR] Beginning Verify and Repair transaction 2019-06-03 22:17:13, Info CSI 00001b3d [SR] Verifying 100 components 2019-06-03 22:26:17, Info CSI 00003e07 [SR] Verify complete 2019-06-03 22:19:56, Info CSI 000024ed [SR] Verify complete "The actionable insights generated by Red Cloak TDR will now be available to organizations who want software-enabled hunting, detection and response capabilities, but also prefer the turnkey support of an experienced provider," said Wendy Thomas, chief product officer of Secureworks. 2019-06-03 22:21:54, Info CSI 00002b8d [SR] Verify complete The hardware seems to be fine. 2019-06-03 22:19:50, Info CSI 00002479 [SR] Verifying 100 components 2019-06-03 22:24:18, Info CSI 0000360c [SR] Verify complete 2019-06-03 22:22:17, Info CSI 00002ce4 [SR] Verify complete 2019-06-03 22:10:07, Info CSI 000003a8 [SR] Beginning Verify and Repair transaction 2019-06-03 22:18:41, Info CSI 00001fd2 [SR] Verifying 100 components 2019-06-03 22:20:59, Info CSI 00002825 [SR] Verifying 100 components The processes that produce excess CPU demand vary. Please run the fix it tools from the link below to check for issue resolution. 2019-06-03 22:23:21, Info CSI 00003186 [SR] Verify complete https://issues.redhat.com/browse/KEYCLOAK-13911 . 2019-06-03 22:22:52, Info CSI 00002f18 [SR] Beginning Verify and Repair transaction Follow @Secureworks on Twitter Secureworks Red Cloak Endpoint requires outbound traffic to be added to the allowlist for: Specific system requirements differ whether Windows or Linuxis in use. The Secureworks MDR service includes threat hunting to proactively isolate and contain threats that evade existing controls, and it comes with IR support for peace of mind during critical investigations. 2019-06-03 22:15:01, Info CSI 000012dc [SR] Verify complete 2019-06-03 22:28:43, Info CSI 000047d0 [SR] Beginning Verify and Repair transaction We have a keycloak HA setup with 3 pods running in kubernetes environment. 2019-06-03 22:28:18, Info CSI 000045ea [SR] Verify complete 2019-06-03 22:14:34, Info CSI 00001119 [SR] Verifying 100 components 2019-06-03 22:28:39, Info CSI 0000478f [SR] Verify complete If I start in Safe Mode, download speed does not drop with time. Hello! Then it listed startup items (Java, IDT PC Audio, Intel Common User Interface (listed 3X), MS security client, Intel Wireless, and IAStorIcon) none of which should be an issue. If any objects are detected, uncheck any items you want to keep. 2019-06-03 22:21:06, Info CSI 00002894 [SR] Verifying 100 components Axonius Adapters: Tools, One Unified View. 2019-06-03 22:18:48, Info CSI 00002044 [SR] Verify complete We ran UMA traffic with 10000 users at about 400 requests/second for around 10 hours. But for example this morning I have 4 WORD documents open, 13 IE 11 tabs open, Outlook open, 6 Excel spreadsheets open, and yet CPU usage is running below 10%. If I shut down all applications before the CPU gets totally consumed then the demand of the little services will slowly return to normal (30-60 minutes). 2019-06-03 22:12:39, Info CSI 00000bf0 [SR] Beginning Verify and Repair transaction . 2019-06-03 22:28:39, Info CSI 00004790 [SR] Verifying 60 components 2019-06-03 22:09:31, Info CSI 000000d4 [SR] Verifying 100 components Fix result of Farbar Recovery Scan Tool (x64) Version: 01-06-2019. Restart Red Cloak service: systemctl restart redcloak. step 3. 2019-06-03 22:11:02, Info CSI 00000752 [SR] Verifying 100 components 2019-06-03 22:26:52, Info CSI 0000407b [SR] Verifying 100 components What seems to happen is that something triggers high demand and then every process on the computer joins in. 1. 2019-06-03 22:10:15, Info CSI 00000411 [SR] Verifying 100 components 2019-06-03 22:15:48, Info CSI 00001592 [SR] Beginning Verify and Repair transaction Here is the eSET log. 2019-06-03 22:15:19, Info CSI 00001415 [SR] Verify complete Netflow, DNS lookups, Process execution, Registry, Memory. step 4. The computer has been on for 4 hours with no problems but the odds are that sometime today, when I least expect it, things will start to get slow and Performance Monitor will show CPU usage skyrocket. If an entry is included in the fixlist, it will be removed. Also, we need to check if the issue is caused due to any application installed on the system. 2019-06-03 22:23:11, Info CSI 000030b3 [SR] Verifying 100 components 2019-06-03 22:10:26, Info CSI 000004e3 [SR] Verifying 100 components 2019-06-03 22:23:11, Info CSI 000030b4 [SR] Beginning Verify and Repair transaction 2019-06-03 22:22:47, Info CSI 00002eaf [SR] Verifying 100 components 2019-06-03 22:12:59, Info CSI 00000cdb [SR] Verify complete Secureworks: Cybersecurity Leader, Proven Threat Defense | Secureworks ESET will now begin scanning your computer. 2019-06-03 22:16:24, Info CSI 000017bb [SR] Verify complete Additionally, malware can re-infect the computer if some remnants are left. 2019-06-03 22:12:02, Info CSI 00000a23 [SR] Verify complete . . Intel Dual Band Wireless-AC 3160 = Wi-Fi (Connected), Host Name . 2019-06-03 22:23:38, Info CSI 000032c0 [SR] Verifying 100 components Ravi,are you suggestingrunning applications "in pairs" to see if there are interactions that are different in one pair or another? 2019-06-03 22:13:26, Info CSI 00000e20 [SR] Verifying 100 components We currently have secureworks for part of our IDS/IPS response, use red cloak on our servers and have iSensors inbetween our firewalls and internal network. 2019-06-03 22:21:13, Info CSI 00002900 [SR] Verify complete 2019-06-03 22:14:27, Info CSI 000010aa [SR] Beginning Verify and Repair transaction Occasional problems with computer speed as well and when I checked Resource Monitor I would see CPU usage bumping 100%. Stop doing this. Secureworks (NASDAQ: SCWX) is a global cybersecurity leader that protects customer progress with Secureworks Taegis, a cloud-native security analytics platform built on 20+ years of real-world threat intelligence and research, improving customers ability to detect advanced threats, streamline and collaborate on investigations, and automate the right actions. 2019-06-03 22:16:38, Info CSI 00001903 [SR] Beginning Verify and Repair transaction 202-744-9767, Visit secureworks.com 2019-06-03 22:16:45, Info CSI 00001977 [SR] Verifying 100 components 2019-06-03 22:17:05, Info CSI 00001ac5 [SR] Beginning Verify and Repair transaction 2019-06-03 22:26:59, Info CSI 000040e9 [SR] Verify complete For more information about creating a group or locating the registration key, reference How to Create a Secureworks Taegis . 2019-06-03 22:16:45, Info CSI 00001976 [SR] Verify complete I've had an independent computer repair shop look at it and they have suggested an essentially undiagnoseable hardware issue. 2019-06-03 22:18:26, Info CSI 00001efc [SR] Verifying 100 components https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19620. 2019-06-03 22:10:15, Info CSI 00000412 [SR] Beginning Verify and Repair transaction The adware programs should be uninstalled manually. ), 2019-05-24 08:23 - 2019-05-24 08:26 - 000011616 _____ C:\Users\Kim Thoa\Downloads\FRST.txt, ==================== One month (modified) ========, 2019-05-24 08:26 - 2018-09-15 00:33 - 000000000 ___HD C:\Program Files\WindowsApps, ==================== SigCheck ===============================, (There is no automatic fix for files that do not pass verification. We ran UMA traffic with 10000 users at about 400 requests/second for around 10 hours. 2019-06-03 22:23:42, Info CSI 0000332a [SR] Beginning Verify and Repair transaction Wireless LAN adapter Local Area Connection* 2: Wireless LAN adapter Local Area Connection* 1: Ethernet adapter Bluetooth Network Connection 2: "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully. Thanks. 2019-06-03 22:22:35, Info CSI 00002de1 [SR] Beginning Verify and Repair transaction 2019-06-03 22:18:41, Info CSI 00001fd1 [SR] Verify complete 2019-06-03 22:21:23, Info CSI 00002972 [SR] Beginning Verify and Repair transaction 2019-06-03 22:11:48, Info CSI 000008ef [SR] Verifying 100 components 2019-06-03 22:25:09, Info CSI 00003973 [SR] Verifying 100 components However, as of Windows Agent 2.0.7.9 it is confirmed to be corrected. Items that are especially important will be highlighted in. 2019-06-03 22:20:42, Info CSI 00002745 [SR] Beginning Verify and Repair transaction 2019-06-03 22:18:41, Info CSI 00001fd3 [SR] Beginning Verify and Repair transaction 2019-06-03 22:23:42, Info CSI 00003328 [SR] Verify complete 2019-06-03 22:10:32, Info CSI 0000054a [SR] Verify complete 2019-06-03 22:21:47, Info CSI 00002b24 [SR] Verify complete 2019-06-03 22:17:33, Info CSI 00001c2a [SR] Verifying 100 components 2019-06-03 22:21:30, Info CSI 000029e3 [SR] Beginning Verify and Repair transaction 2019-06-03 22:21:06, Info CSI 00002895 [SR] Beginning Verify and Repair transaction 2019-06-03 22:22:57, Info CSI 00002f7d [SR] Verify complete *Update: CVE-201919620 was assigned for this issue.*. 2019-06-03 22:14:48, Info CSI 000011fa [SR] Beginning Verify and Repair transaction Using Roguekiller before contacting Bleeping computer, performance improved to 9.6MBps, including a bit faster access times after booting. Unveiled today at the Black Hat USA Conference in Las Vegas, this service addition to Red Cloak TDR is available immediately. To contact support, reference Dell Data Security International Support Phone Numbers.Go to TechDirect to generate a technical support request online.For additional insights and resources, join the Dell Security Community Forum. We understand complex security environments and are passionate about simplifying security with Defense in Concert so that security becomes a business enabler. 2019-05-31 08:59:22, Info CSI 00000006 [SR] Verifying 1 components 2019-06-03 22:28:35, Info CSI 0000472a [SR] Beginning Verify and Repair transaction Sorry for the slower responses, as this is my Mom's machine. 2019-06-03 22:24:12, Info CSI 000035a5 [SR] Verify complete 2 In cases where Secureworks Red Cloak Endpoint supports an . I opened a support ticket to review and we started looking at various log files. . 2019-06-03 22:22:10, Info CSI 00002c64 [SR] Beginning Verify and Repair transaction I assume since I also was involved in all 3 . "Our vision for a software-driven SOC of the future is one that pairs machine intelligence with human insight to take the guesswork out of incident response and give the adversary nowhere to hide," said Thomas. 2019-06-03 22:24:12, Info CSI 000035a7 [SR] Beginning Verify and Repair transaction 2019-06-03 22:16:24, Info CSI 000017bc [SR] Verifying 100 components 2019-06-03 22:22:27, Info CSI 00002d69 [SR] Verifying 100 components I was experiencing slowing of my download speed - dropped in half every 2 hours or so after a restart. 2019-06-03 22:19:44, Info CSI 0000240d [SR] Verify complete 2019-06-03 22:26:17, Info CSI 00003e09 [SR] Beginning Verify and Repair transaction 2019-06-03 22:21:23, Info CSI 00002970 [SR] Verify complete 2019-06-03 22:25:43, Info CSI 00003bf4 [SR] Beginning Verify and Repair transaction Trivial local bypass of Secure Works Red Cloak telemetry discovered August 2019. ), (If needed Hosts: directive could be included in the fixlist to reset Hosts. With Secureworks, we are able to crunch down that number to 20-30 high fidelity alerts and that makes my team's job much easier. 2019-06-03 22:12:14, Info CSI 00000a9f [SR] Beginning Verify and Repair transaction Description. 2019-06-03 22:25:50, Info CSI 00003c63 [SR] Verifying 100 components 2019-06-03 22:27:20, Info CSI 0000423b [SR] Verify complete Running additional tools on your system can interfere with the clean-up process, or cause issues such as false positives. 2019-06-03 22:23:30, Info CSI 00003256 [SR] Verify complete I explored a lot of possible issues but none resolved the problem so I reinstalled Win 7 on Friday, January 16. 2019-06-03 22:09:22, Info CSI 00000007 [SR] Beginning Verify and Repair transaction They would not work on the computer because they felt they could not solve a problem that was neither predictable or reproducible. 2019-06-03 22:24:06, Info CSI 00003537 [SR] Beginning Verify and Repair transaction 2019-06-03 22:23:11, Info CSI 000030b2 [SR] Verify complete 2019-06-03 22:10:01, Info CSI 0000033f [SR] Verifying 100 components 2019-06-03 22:18:11, Info CSI 00001e22 [SR] Verifying 100 components Save and quit by hitting ESC and typing: :wq! 2019-05-31 08:59:26, Info CSI 0000000d [SR] Verify complete 2019-06-03 22:27:20, Info CSI 0000423c [SR] Verifying 100 components memory: 2Gi At the time of discovery, my (then) employer was using a suite of SecureWorks services, with a product called Red Cloak being a core component. Note: [PATH] = The full directory path to where the taegis-agent_[VERSON]_x64.msi file is located. Problem solved. 2019-06-03 22:24:23, Info CSI 00003675 [SR] Verify complete 2019-06-03 22:12:28, Info CSI 00000b7c [SR] Verify complete 2019-06-03 22:27:06, Info CSI 0000415c [SR] Verify complete 2019-06-03 22:25:17, Info CSI 000039df [SR] Verifying 100 components 2019-06-03 22:12:59, Info CSI 00000cdc [SR] Verifying 100 components 2019-06-03 22:23:47, Info CSI 00003398 [SR] Verify complete 2019-06-03 22:12:02, Info CSI 00000a24 [SR] Verifying 100 components The problem was temporarily (a day or two) fixed by the reinstall.