If you ran Malwarebytes and it came up clean, why do you think there is a keylogger installed?

If your computer is autocompleting, it doesn't sound like you reformatted, unless you also restored some of what was on before instead of reinstalling the programs. In what program are the email addresses being entered?

The second partition may be a restore partition and not something you want to remove. How did you locate it and what did you do to try to remove it?

you can try running gmer it is to remove rootkits but may find something related to what you think you have.
GMER

other than that you will need to go to one of the security help forums and ask for help there, they have more specialized programs you can run to see what is on the pc and if you do indeed have a keylogger. You can try registering at LzD and asking for help.
Analysis and Malware Removal

I hope you never paid your 'expert' too much money seeing he/she could not remove it.

Did you ever create a recovery CD since buying the computer? If not you need to do so sudden like from that second partition. Then simply insert the CD, reboot and your computer should be restored to the original factory defaults. Be sure to save any personal data first as that will be gone too. Going thius route you can rest assured the computer is clean

As Bpgreen asks, what makes you think it is still on the computer?

I have used the "Linked" program to remove Kloggers that were undetected by Any virus or malware programs.

I myself couldn't even find this one particularly persistent and recurring logger program once .. and that was even after going through Every registry key on the pc! This program found and deleted it!

It's free and I Know that it works.

Hope this will be the help that you need.

Here is a link that might be useful: LOGGER FINDER

carolssis

I am fairly new to these forums so I don't know how or even If you can edit your own posts. (apparently not)

In my post to you .. I made the unforgivable mistake of posting without really proof-reading what I had to say. 8(

Where it says: "This program found and deleted it!" .. it should have said: "This program found it and I deleted it!"

The program will give you the path to the klogger but will not remove it.

It is easy enough to do it(remove)yourself but, If you need a reliable klog remover .. I can post it for you also.

Sorry for the mistake.

I found the keylogger after having many strange problems. It was on Drive C, and I opened most of the folders and files. One folder was labeled "quarantine " and only contained one file, catchme, with date and time. This date and time corresponded with the date and time the crook was here and "checking her email". I use outlook express for email, and did not re-enter any email addresses after the attempt at reformat. I didn't recover the computer after the last attempt at reformat and re-install of operating system from original disk. So, if I didn't recover, how can the partition be a recovery partition. I found it after using "run-cmd" in phone conversation with aforementioned expert. He told me what to type in, and we found it, selected it, and tried to delete it, didn't work.
Back in February is when I called in the expert, I was the one who found the keylogger, I know who installed it, when and how. Standard operating procedure for her, she's a career criminal who steals idenities and sells them on the internet, also she changed our passwords on our email accounts, did all kinds of sneaky illegal stuff, and promptly decamped town to another state.
I fail to see the importance of a recovery cd, since I have the original operating system disks. Seems to me that if I made a recovery disk now, it would only copy the keylogger program and reinstall it from the recovery disk.
Thanks for the responses, will check out the links. :)

"One folder was labeled "quarantine " and only contained one file, catchme, with date and time. This date and time corresponded with the date and time the crook was here and "checking her email"."

Since it was in the quarantine folder, that means that a scan found it and removed its ability to run. Some malware programs will move a program to a quarantine folder rather than completely delete it, but when it's in the quarantine folder it's not running or logging your keystrokes.

I think you misunderstand what I wrote. I found this folder on my hard drive, before anything else was done. I opened the
quarantine" folder, as I did all the other folders, which all opened into notebook, all except one, a DOS-batch file, which of course in not something that can be opened. One of the files, when printed, had a series of strange symbols across the top. These same symbols were across the top of my printed tax return.
I had done no scan to find these files, I was checking out the "C" drive myself in an attempt to find what was causing the strange anomylys, came across a previously "never before seen" folder, and opened it, finding all these interesting files. All the folders and files were lableded with date, time and kb's, which were installed in approximately 12 minutes, amounting to 4700 kb's. Oddly enough, this is the same amount of space on the extra partition!
I had NOt run any programs or scans to find these folders.
Any other ideas? Im at a total loss. I have found 144, modifications of logs and removals, after running "logger finder" as listed above. Does that sound like i have a problem? Looks like it to me, it encompasses almost my entire computer, on system 32, application data, cat root, software distribution, data logs, app data for internet secutity program, data store, etc. What is your opinion? I'm not trained to understand all this.

You might try dban.

carolssis

Without being able to peruse the scan logs that were created by the Klog-finder, there is no way to tell you what to delete or what will erase the key-logger.

I have a suggestion though.

Good Luck

Visit the site below(link).
Make Sure that you read where it says .. This Topic.
Follow the instructions as given.
The folks that I am referring you to are some of the Very Best at what they do.
If the logger is there, they Will find it and help you to delete it .. I promise.

I am in the field myself, (tech) but Nowhere near as qualified as these guys are.

Here is a link that might be useful: BleepingComputer

I already suggested they go to LzD for assistance one of the best on the web, they have helped many here but that does not seem to be the route they want to go so I don't think suggesting BC will help either, I am also a member there too.
We can only suggest help if they don't take it oh well.
this will take researching various log files and that has to be done on a pro help forum.

if you ask for help but do not follow our suggestions we can not very well help. You say you are not trained for this, which is why I suggested you go where they are.
Have you tried any of our suggestions at all?

BTW: There are a number of steps that you will have to go through before the folks over there can analyze your system.
At first it looks like a lot and looks difficult but it isn't.

All of it is laid out, step by step and there is even a PRINT GUIDE that you may want to copy and have at hand.

I am posting the 'print guide' link below just to make it a little easier for you.

Good Luck

Here is a link that might be useful: Print Guide

ravencajun

I'm sorry.
Somehow I missed your post on the LzD suggestion.
I meant no disrespect.

I came upon this topic(sometime yesterday/last-night?)and was having a hell of a time, staying awake.

Like you said though .. Advice will only help .. If you follow it.

Wouldn't mind seeing her HJT log though .. Could prove to be interesting.

Now,kids, I'm not that stupid that I'd ask for help and not take any given. I've been fighting this program for 7 months.

after running the logger finder, as stated in my last post, it listed 144 modifications and removals on system 32, cat root,and many, many other system applications. I hesitate to use another program found online, as the last one instructed me to disable my internet security while running it, and one of the removals was a file from my internet security program.
ravencajun, yes, I did try to use one suggestion, so far. the logger program suggested by just4me. I spoke with my expert today, read him the files I copied from this program when I found it, they include, syspath, cat root, tcpip,all users, various application modifications, so these removal programs tell you to back up the system first. Makes no sense to me, the entire operating system is corrupted, values changed, browser and email settings changed, so why copy bad information? I wish you could see the pages and pages of information I printed out from the program when I found it. It changes values in syspath, isn't that pretty serious?!
Since the computer will not format, it makes sense to me that I find a way to go into the hard drive and turn every byte to "0" and start over from there. Would that not ensure the hard drive is clean? Also, one of the really neato things this keylogger has done is turned off the cd-writer, it's listed under "disabled" in BIOS set up utility. When you look in device manager, it's listed as working properly, but it isn't. All the cd's I Thought I was copying files to were blank after the attempt at reformat and reinstall of OS. I hope all this info will help you all understand the scope of what I'm trying to deal with. Thanks for all your time, thought and suggestions.

justme4now, no absolutely no offense taken at all, I am 100% with you in wanting to see several logs HJT being one of them, with out those logs and some others not much can be accomplished. This forum is not the kind of forum that can provide that level of help, which is why we are trying to urge going to one of the pro help forums where logs would be done. LzD is great, they really work well with giving good direction and patience, and are used to referrals from GW.

carolssis at the very least go to the link I provided to LzD forum and view some of the help given there, they work wonders daily helping people clean their systems, they can lead you step by step and get the logs needed. They are professionals donating their time.

I still think DBAN will wipe the disk clean if you give it a try. If not use a linux live disk to do the job.

From your Sept 5th post:- I fail to see the importance of a recovery cd, since I have the original operating system disks.

There is no point you creating any recovery disks but as you never said you had the operating system I made the suggestion.

If you have the Windows CD why allow the corrupt computer to hound you for months? Just wipe the drive and start over all squeaky clean.

From your Saturay post:- Since the computer will not format

Why can't you reformat the drive? Bob offered a good solution and linked to the DBAN site for you to download from.

I'll be honest with you.
If I were to ever run into, what seems to be an unsolvable problem such as this .. I would probably just replace my hard-drive altogether.
Keep the old hard-drive and later, you can recover what important items May remain on it.
You can purchase 1TB drives from makers like Western Digital now for under $100.00.

Just a thought.

I attempted to reformat the hard drive in Feb.09. Have visited Gmer, it closed while running. I think I ran logger finder. Am so tired, not sleeping but a few hours.
I would love to replace hard drive, but I just lost my job, need computer for unemployment reporting. I've tried so many things in the last few days, I'm at a loss to recall them all. I did go to bleeping computer, ran program, posted HJT log. Several areas printed hooked files. Will try dban next. I truly appreciate your help. I know it takes you time to read my posts, and your knowledge to make suggestions to help me. Thanks you all so much. At present there are six programs on my desktop that I've tried in the last few days. Am making an effort to write them down, so I can keep track of what I've done. I've also been printing out what these programs are finding. Racking up a mighty pile of paper, believe me, now, if I only knew what it all means!!! By the way, the original program I found on my hard drive was "Qoobox" included were: backenv, registry backups,quarantine,last run, which has drevB included. Also there was a DOS-Batch file. I printed out everything I could from all that, which is the files I tried to show to my 'expert'.
Have run programs that you all have suggested. Don't know enough to understand what it all means. Will go to dban next. Thanks again, everyone, I really appreciate all your time, knowledge and suggestions, which I am taking advantage of. Tnanks, thanks, thanks.