and recorded each keystroke. Which means it also got the mistakes he made and everything else he typed.
Also I think there is a way you can hide the program in Windows to not appear in the Task Manager, at least that is what those Taskbar docked applications do, just remove the Taskbar icon and it is impossible to detect. You know, those icons on the right side part of the taskbar where the clock is.
Sometimes the virus people rename their virus code to something like "rundli" or something that looks like rundll so you think it is a system process.