Remembering after the fact, during one or two of the system scan(s) in Safe Mode, there was a notable display of two files, in DOS mode by the way, using AVG, so I jotted it down:
found trackng cookie. Serving - sys here 386\RASTLS.DL_ here here 386\WFWNET.DR_