it is a machine that was syncing with the crytolocker machine, and the onedrive was encrypted. So it spent a month or so trying to sync back the help_decrypt files. The one drive is now clean and no new threats are detected. I have deleted the object before and it comes back with the same stuff :/ I did it again, it should come back in an hour or so, i will report back then.