This sounds like a job for safe mode. If the file is always three chars and the numeral 1 in the temp directory it should be hard to find. Safe mode will prevent it from starting so you'll be able to delete it. It'd be interesting to know if this is a program that adaware and the like havn't heard of, as I'm sure they'd be interested.

Matthew