Please follow the advice of one member in the order that advice was given, including any follow-up analysis or suggestion.
Callender suggested technibble - follow that path before anything offered here.
An orderly approach to trouble shooting is the only way to maintain sanity
From the picture in
post# 9, the file has no extension. It has the system attribute set and it has been around for quite a while (modify 2013-01-07)

Nick, please post the attributes of the file
command prompt
f:
cd \
attrib hehe\*.*
exit
There are a few ways to get around Windows - both require booting to another device.
Windows Repair Disc
--OR--
Linux flash drive.
1. Download the Rufus bootable USB drive creation utility 2. Download the Linux Mint Mate ISO 3. Create a bootable USB thumb drive using Rufus and the Linux Mint Mate ISOMint Mate is 1.3 GB, so you need a thumb drive with at least 2 GB.
:warn: Creating a bootable thumb drive erases all data on the thumb drive.
:warn: If you have data on the thumb drive that you need, move it to your Hard Drive or burn it to an Optical Disc.
- Connect the USB thumb drive to a USB port
- Launch Rufus

- The fields in Rufus are filled in with defaults. The defaults work well, but a few things need to be verified or changed.
- Verify that Rufus selected the thumb drive you want to write. Change the Device if the wrong USB thumb drive is presented in that field.
- Change Create a bootable disk using from the default to ISO image
- Select Linux Mint Mate ISO as the source. The file should appear on the status bar
- unTick Create extended label and icon files
- Compare your Rufus window with the image above. If everything other than the Device field are the same, then continue to the next step. Note that the ISO name in the status bar is subject to change as new versions are released
- Press the Start button
- The status bar notifies you when the process is Done
- Press the Close button
Leave the Linux Mint Mate thumb drive connected for the next steps
4. Boot to Linux Mint MateSave any files you are working on, then Restart your machine
Check your machine documentation to determine the key that brings up the Boot Order startup menu. This example is from an HP laptop that assigns it to the F9 key.
When the machine begins to start again (black screen) tap the F9 key to bring up the Boot Order startup menu. There is only a short time to "catch" the Boot Order menu. If Windows starts, you will have to try again.
Whichever boot you decide on, there is probably still a permissions issue - you'll need to change the attributes / permissions before you try to delete the file.
Even if you get the file removed, you still need to determine where it came from ... is it malicious? I believe it is, but Malwarebytes and AdwCleaner came back clean.
I would try the following before resorting to the boot option above, but it's your choice.
There are a few other utilities you might want to try
Warning
Before running any repair utility:
- Save any open files
- Close ALL applications
- Disconnect from the Internet unless the application requires a connection
- If the application prompts you to restart your system - restart your system.
Old Timer-Temp File Cleaner (TFC)
Restart your machine in case there are any system operations pending
Old Timer-Temp file Cleaner (TFC)
Note
This utility
- is a standalone application, there is no install.
- does not require a connection, please disconnect after the download has completed.
1. Click on the
Save button on the
Do you want to run or save ... action bar to save the package in your Downloads folder.
For example: C:\Users\Dad\Downloads
2. Click the
Open folder button when the
... download has completed action bar is presented
Right click
TFC (it should be highlighted) and select run as administrator
--> Answer Yes to the UAC dialog window
:warn:
Save your work and close all open windows.
TFC will close ALL open programs
including your browser!
3. Click the Start button to begin the cleaning up temporary files and folders.
:warn: Do not work on other things while TFC is running - most applications use some sort of temporary files. Just let TFC run by itself on the machine until it completes.
:busted: If TFC prompts you to reboot, do so immediately.
:busted: If TFC does NOT prompt you, then reboot your machine immediately after TFC has completed.
RESTART your machine after running TFC
Junkware Removal Tool (JRT)
Information
Author's page:
Malware Analysis and Removal: Junkware Removal Tool (JRT) Released - Freeware
About
Many of the infections we see on the forums and in the work environment nowadays involve a user that has an unwanted program, toolbar, or browser helper object (BHO) on their computer.
Some examples include (but not limited to):
Ask Toolbar, Babylon, Browser Manager, Claro / iSearch, Conduit, Coupon Printer for Windows, Crossrider, Facemoods / Funmoods, iLivid , IncrediBar , MyWebSearch, Searchqu, Web Assistant
The tool is designed to remove all traces of these types of programs which includes services, registry values, registry keys, files, and folders. The tool will also restore some default settings for Internet Explorer and Mozilla FireFox. Google Chrome is not supported (perhaps in future).
The tool is non-interactive so the user can simply open it by double-clicking and wait for the log report (JRT.txt) to open when the tool is finished.
A copy of the log is saved to the user's desktop incase you want the user to attach the log.
Note
This utility
- is a standalone application, there is no install.
- does not require a connection, please disconnect after the download has completed.
Junkware Removal Tool (JRT)
1. Click on the
Save button on the
Do you want to run or save ... action bar to save the package in your Downloads folder.
For example: C:\Users\Dad\Downloads
2. Click the
Run button when the
... download has completed action bar is presented
--> Answer Yes to the UAC dialog window
3. JRT opens a Command Prompt widow which displays some operational information. Read the screen and press any key when you're ready to continue.
4. The scanner initializes and runs. When JRT finishes, it reports the status of the scan in the Command Window and presents the log in your default text editor.
-> Save the log as JRT_SFProfileName.txt
For example: JRT_Slartybart.txt
RESTART your machine after running JRT
5.Attach the log file to a new post on your thread.
Attach the JRT log