A thought occurs to me, first of all I was trying to work out why would anything save to sys32 as a default rather than the normal default of user\downloads and also hide it's self, this would be the place where a virus/trojan would want to be so I suggest he does a scan with malwarebytes and super anti-spyware followed by a scan with his virus checker just in case