sychost.exe under system32\helpefa

Possibly a key / activity logger.
Saves log in the system32 folder and also seems to dump its log everywhere in the C drive.

Keystroke, URL, Title of the window… all logged! :slight_smile:

I wonder if Avast will detect this?
Has been sent to Avast for further detection.

Stop wondering :smiley:
It is the W32.HLLW.Leox.B, and that one is detected by Avast

Nope… not detected by Avast…