It came back yesterday so did a malwarebytes scan nothing found, did a spybot search and destroy and did a refresh and it went away.
Seems there is some file attachment going on "maybe this a new Spam attack method. will check the files next time and see if I can see the file name"
When I googled this issue some others are having the problem too.