I've run into this before, spybot and malwarebytes (had to use both, one didn't completely get it, and on reboot it reached out to the web and found the file again) while in safe mode with NO networking.