4/21/16, a DL was attempted from a PC with a bare-metal reinstall of Win7, after the 3 hour update of Important updates only, with updated MSE plus Norton, with no GWX icon: Norton gave the red X and deleted it, from ImgBurn (#7), then same action from 2 others on the list. At some other place (don't recall), DL worked. MBAM found the OpenCandy PUP, Norton Insite said it was about 1 week old so no good info yet. Explorer Properties said it was ver 3.something. A bit later, this file was also deleted somehow.
A DL was attempted on another PC that has many apps, no reinstall for over 3 years but kept up-to-date, no more Optional or Recommended updates thus no GWX icon also (exiting the free Outlook email no longer pops up the GWX): It succeeded from ImgBurn so no other DL sites were tried. It is SetupImgBurn.exe, 3469871 bytes, ver 184.108.40.206 (Details tab).
How can this be explained? A freshly 'made' Win7 x64 SP1 PC, with a few apps ie LibreOffice, SyncBackFree, KDiff3, FoxitReader Free, etc, updated and had full scans, 'find' malware in ImgBurn, while an older, more questionable PC got a clean DL albeit with OpenCandy? (I do not know how to do the file checking, ie md5 etc.)