Stubborn trojan stashes install file in Windows help.
Security researchers have spied malware that stashes a copy of itself in a Windows help file to ensure victim computers remain infected.
The trojan, dubbed Muster.e by anti-virus provider McAfee, infects a Windows file called imepaden.hlp so it stores the main components of the malware in encrypted form. In the event the installed malware is removed, the secret payload is decrypted into an executable file called upgraderUI.exe and run by a companion installation file that automatically runs as a Windows service.
Source - Stubborn trojan stashes install file in Windows help ? The Register