From the doc: 'only 4.5 kb copies itself to the c:windowssystem folder as regback.exe adds itself to the registry in: SoftwareMicrosoftWindowsCurrentVersionRunServices as 'RegistryBackup',regback.exe saves the log file in c:windowssystemegback in 'month.day.extention' format example '9.14.ILL' will be the log for today'
Keylog-Ill [McAfee]security risk or a "backdoor" program [F-Prot]Trojan Horse [Panda]Trojan.Spy.ILLTrojan.Spy.ILL [Kaspersky]TrojanSpy.Win32.ILL [Kaspersky]Win32.ILLog [Computer Associates]Win32/ILL!Spy!Trojan [Computer Associates]
keylog.exe