Thanks Ame.
It's a "desktop hijacker" it periodically takes screen images of my computer and I guess sends it to the hacker.

Gay