Thanks, Asyn, for the help so far.
@ kevbeck,
Could you copy/paste the resubmitted vt scan in your next reply?
I have no way of knowing if the vt scan I found was your vt report as the original url was not pasted in your prior reply, so I submitted a new fresh scan from my Win 7 system; this resulted in the prior scan being lost at the moment. I am sure that report can be recovered, but have not yet been successful in doing so.
Even tho the scan came out clean, there was a suspicious element in that the file submitted performed two operations while analyzed it maybe should not have:
xcopy, and another operation I forgot to write down.
What now is there @ vt is the most recent analysis; it is the same file but it is submitted from my Win 7 system. It did not show these two operations, or any, occurring at all.
So, the current report is different from yours, this is assuming you were the last one to submit that file for analysis.
You may need to resubmit your file for analysis as I am not able to recover the prior report from here.
Sorry about that, but this is one of the reasons why I do not propose running certain programs that can possibly damage an user's system and running subsequent fixes based on the logs from them. Do not wish to cause harm here.
I do think the two operations discovered may well be suspicious if the the prior report was submitted by you, especially if. as you say, avast! is sandboxing your ctfmon.exe file every time it runs.
We need to find out why that is happening.
Awaiting your reply with the resubmitted pasted vt url link.
[EDIT:] Never mind, I think I've found it using Google: https://www.virustotal.com/en/file/6bb5f3a7147660db416b838893c7d0734872ada9f7db68b1d019043a1cb89397/analysis/ 
Look into the 'Relationships' Tab to see what is there under CarbonBlack.
