Hi Wayne,
It would be best to check the file that resides in the system32 folder as well. The desktop located entity can either be a copy of the sys.32 file or just a shortcut to it depending on how it was placed on the desktop. The 2 of course can also be compared to each other. (If the desktop entity is indeed a copy it would/should be a newly written entry on the HDD in a new place on it even if/as it was saved to the same system drive/partition, a shortcut would be just that, not a new copy of the file itself). The intermittent nature of it running one time but not before and after is indeed puzzling, is it time for a disk integrity scan? But then the OP stated that his son's device showed the same behavior. Hmmm....