Yep, that’s the culprit. Does it still come back if you remove it and manually delete all contents of C:\WINNT\TEMP in Safe Mode?
Hmm, I don’t normally go in and delete things. My Guru is coming over Friday, we’ll run Adaware once, and then also go delete that file in safe mode.