From the doc: 'This program is a Keylogger/Desktop Picture Capture that runs in the background hidden from view. The program will be installed in the C:Program Files directory and in the folder: Helper. The keystrokes will be stored in a "timestamped".log file in the application's folder. The Desktop picture is captured at default of 5 min. (this can be changed at the Options menu) and is stored in the application's folder. To access the Options menu press the "CTRL","ESC" & "F1" at the same time. The Desktop picture are timestamped when they are captured. When the program is started and stopped it is time stamped in the .log file. The program auto run on startup of Windows by using a registry "run" key. This entry will be deleted when the program is uninstalled. The auto start can be turn on/off in the options menu. The log files and the picture files can now be viewed in the options menu.'
TrojanSpy.Win32.VB.I
Program Fileshelperhelp.exeWindows emp\_istmp0.dirstrap.exe
Windowssystem32cat.dll
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionunishelp