just ran ClamXav found KeyLogger

Normally I would ask that you submit it to ClamXav as a possible FP, but since you've already deleted it and the situation is fairly complicated, I'll take that on myself and let the ClamXav signature team decide what to do about it.

InsecureSpike wrote:

the actual app had been deleted sometime ago, so could be just left over stuff that didn't get deleted?

Yup. If you just dragged the app to the trash, it would have left that agent behind. However, as far as I could tell, there was no mechanism for loading that agent beyond running the main app, so it probably wasn't running anyway.

thomas_r. wrote:

as far as I could tell, there was no mechanism for loading that agent beyond running the main app, so it probably wasn't running anyway.

It adds itself to the user's Login Items. See details in e-mail.

I'd suggest getting rid of both Sophos and Avira.

Read this article. It's an effective defense against the fear-mongering click bait out there:

Effective defenses against malware and other threats

It's also possible that ClamXav is incorrectly labeling an innocuous file as a keylogger. That sort of thing happens quite a bit.

+1

I will occasionally run Malwarebytes.

https://www.malwarebytes.com/mac/

You actually have too many av programs.

Several reviews on MacUpdate seem to confirm that it does install a keylogger. Will be checking this out as time permits.