I don't think i made myself quite clear enough. The program/keylogger is installed in the virtual OS (VMware) scanning the VM files isn't going to help and even scanning with a virus scanner inside the OS may not do anything.. I've told you how i found out.
I saw in the download dir of firefox an .rar of the cracked keylogger. Did some research on it and found you could unlock it given you had the password by typing out 'unhide' in run then typing in the password. So i tried such to confirm it, then immediately deleted the files and told you guys. If you try this and its not there sorry for the inconvenience i guess? Also i hope that clearing this up will help the minions or such in closing the matter promptly.