# EX from hell spying on me **URL:** \ **Category:** Factual Questions\ **Created:** [August 26, 2002, 2:41pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628 "2002-08-26T14:41:54Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [August 26, 2002, 8:35pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/21 "2002-08-26T20:35:47Z")
Another vote for reformat and reinstall. That’s probably the only way you’re guaranteed to be rid of it. ---
**Author:** ![AndrewL](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@AndrewL](https://boards.straightdope.com/u/AndrewL)\ **Post date:** [August 26, 2002, 8:46pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/22 "2002-08-26T20:46:27Z")
[http://www.hackguard.net/](http://www.hackguard.net/) has information on the backdoor this program uses, and step-by-step do-it-yourself removal information. Personally I’m amazed that a company like Spector can get away with this kind of thing legally. ---
**Author:** ![stpauler](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stpauler](https://boards.straightdope.com/u/stpauler)\ **Post date:** [August 26, 2002, 8:47pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/23 "2002-08-26T20:47:05Z")
Info found at: [http://faculty.ncwc.edu/toconnor/495/495lect15.htm](http://faculty.ncwc.edu/toconnor/495/495lect15.htm) Spector is perhaps the most powerful and common spyware. It adds several files to the C:\Windows\System directory, including mswnsrvx.cnt, mswnsrvx.exe, mswnsrvx.hlp, shmswnmp.dll, and shmswnrc.dll (all of these are hidden files). The easiest way to determine whether you are under surveillance by Spector is to check for the C:\Windows\System\WebExt directory, which contains files with names like “4F0BF6D8.TPS.” There may also be a master log file called “\_MSFILEA.TXT”, which shows when each capture file starts. The WebExt directory isn’t hidden, but it can be changed to another name to make it harder to detect. ``` EBlaster is recognizable by its main program file, which is 468KB URLMKPL.DLL, in the Windows/System folder. Also added are msskfzwin.dll, msskfzwin.ocx, and winmsskfzwin.drv. EBlaster must send e-mail outbound to report on you. Severing your network connection will only cause reporting to be delayed. ``` ---
**Author:** ![Powers106](https://avatars.discourse-cdn.com/v4/letter/p/c57346/32.png) [@Powers106](https://boards.straightdope.com/u/Powers106)\ **Post date:** [August 26, 2002, 9:16pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/24 "2002-08-26T21:16:16Z")
> [@](#): > > \*\*Severing your network connection will only cause reporting to be delayed. \*\* :eek: You are being followed by the Borg…resistance is futile…:eek: ---
**Author:** ![handsomeharry](https://avatars.discourse-cdn.com/v4/letter/h/e9c0ed/32.png) [@handsomeharry](https://boards.straightdope.com/u/handsomeharry)\ **Post date:** [August 26, 2002, 11:40pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/25 "2002-08-26T23:40:26Z")
rat this ex out to the feds…they should be able to fix your computer and avenge you…you may even get on 60 minutes or something! ---
**Author:** ![kevja](https://avatars.discourse-cdn.com/v4/letter/k/aeb1de/32.png) [@kevja](https://boards.straightdope.com/u/kevja)\ **Post date:** [August 26, 2002, 11:58pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/26 "2002-08-26T23:58:41Z")
and people wonder why some people won’t “commit” to a long term relationship. don’t have a clue about the computer, but you have my deepest sympathy/empathy regarding your ex. ---
**Author:** ![aramis](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@aramis](https://boards.straightdope.com/u/aramis)\ **Post date:** [August 27, 2002, 1:46am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/27 "2002-08-27T01:46:12Z")
Here’s a trick that _may_ work as a stopgap measure. It sounds like the email is going direct from your computer to the ex. What you can do is edit your hosts file to make sure that mail can never reach it. The program may still be trying to send out reports but won’t be able to – neither will you for that matter. Look in your windows folder for a file called _hosts_ (no extension). In Windows NT and 2000 (and probably XP but I’ don’t know) it’s in /WINNT/SYSTEM32/DRIVERS/ETC. Open it with notepad and you’ll see one or more lines that look like this: ``` 127.0.0.1 localhost ``` a four-part number followed by a name. All you need to do is add another line to the file that says: ``` 127.0.0.1 exesdomain.com ``` For the number, use the exact one shown here. It’s a special address called loopback and points your very own PC. For the name, use whater domain name you’d use to send her email. If her addess is [psycho@someisp.com](mailto:psycho@someisp.com), use [someisp.com](http://someisp.com). As I said at the top, this is really only a stopgap measue. You really need to re-install the OS. On the bright side, though most folks consider the two (format and re-install) intimately intertwined, they’re not. It really isn’t necessary to reformat a drive to re-install the OS. If you have a zillion MP3 and picture and document files lying about, just leave them where they are. After the installation, they’ll still be there waiting for you. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [August 27, 2002, 2:10am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/28 "2002-08-27T02:10:13Z")
I agree with handsomeharry on this. This is a legal matter (esp with CC fraud), and now that ex is in another state it’s a fedral matter. Invasion of privacy, stalking, CC theft, and probably some more. Also call up the CC company and get the charges taken off. ---
**Author:** ![sigSEGV](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@sigSEGV](https://boards.straightdope.com/u/sigSEGV)\ **Post date:** [August 27, 2002, 2:14am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/29 "2002-08-27T02:14:16Z")
> [@](#): > > \*Originally posted by aramis \* > \*\*Here’s a trick that _may_ work as a stopgap measure. > > It sounds like the email is going direct from your computer to the ex. What you can do is edit your hosts file to make sure that mail can never reach it. The program may still be trying to send out reports but won’t be able to – neither will you for that matter. Look in your windows folder for a file called _hosts_ (no extension). In Windows NT and 2000 (and probably XP but I’ don’t know) it’s in /WINNT/SYSTEM32/DRIVERS/ETC. Open it with notepad and you’ll see one or more lines that look like this: > > ``` > 127.0.0.1 localhost > > ``` > > a four-part number followed by a name. All you need to do is add another line to the file that says: > > ``` > 127.0.0.1 exesdomain.com > > ``` > > For the number, use the exact one shown here. It’s a special address called loopback and points your very own PC. For the name, use whater domain name you’d use to send her email. If her addess is [psycho@someisp.com](mailto:psycho@someisp.com), use [someisp.com](http://someisp.com). > \*\* That is not likely to work. [someisp.com](http://someisp.com) will only be one single host and is not necessarily where mail will be delivered. The better way would be to look up the MX record for [someisp.com](http://someisp.com) and add separate hosts file entries for every MX entry for the domain. For example, [straightdope.com](http://straightdope.com)’s mail exchangers. \>nslookup -type=MX [straightdope.com](http://straightdope.com) [straightdope.com](http://straightdope.com) MX preference = 20, mail exchanger = [mail.uu.net](http://mail.uu.net) [straightdope.com](http://straightdope.com) MX preference = 10, mail exchanger = [mail.chireader.com](http://mail.chireader.com) [straightdope.com](http://straightdope.com) nameserver = [auth03.ns.uu.net](http://auth03.ns.uu.net) [straightdope.com](http://straightdope.com) nameserver = [auth50.ns.uu.net](http://auth50.ns.uu.net) [auth03.ns.uu.net](http://auth03.ns.uu.net) internet address = 198.6.1.83 [auth50.ns.uu.net](http://auth50.ns.uu.net) internet address = 198.6.1.161 You would then put two entries in your hosts file for each MX record: 127.0.0.1 [mail.uu.net](http://mail.uu.net) 127.0.0.1 [mail.chireader.com](http://mail.chireader.com) And this would only work if the spyware program has its own SMTP delivery mechanism. If it is really using built in email software, the email will just be delivered to the victim’s ISP SMTP servers to be forwarded, where hosts file entries won’t matter anyway. ---
**Author:** ![Hodge](https://avatars.discourse-cdn.com/v4/letter/h/5f9b8f/32.png) [@Hodge](https://boards.straightdope.com/u/Hodge)\ **Post date:** [August 27, 2002, 2:17am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/30 "2002-08-27T02:17:13Z")
> [@](#): > > \*Originally posted by aramis \* > \*\*It really isn’t necessary to reformat a drive to re-install the OS. If you have a zillion MP3 and picture and document files lying about, just leave them where they are. After the installation, they’ll still be there waiting for you. \*\* Very Bad Idea. There could be spyware/virus files scattered all over the harddrive that a mere OS re-install wouldn’t have any effect on. As a matter of fact, not only woud I reformat, I would also debug the boot sector before reinstalling the OS, [see this link for details](http://www.firmware.com/support/bios/hdclear.htm). Good luck. ---
**Author:** ![GopherGod72](https://avatars.discourse-cdn.com/v4/letter/g/f0a364/32.png) [@GopherGod72](https://boards.straightdope.com/u/GopherGod72)\ **Post date:** [August 27, 2002, 2:18am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/31 "2002-08-27T02:18:25Z")
debug that bitch… then your computer too. ---
**Author:** ![bhb](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bhb](https://boards.straightdope.com/u/bhb)\ **Post date:** [August 27, 2002, 2:38am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/32 "2002-08-27T02:38:28Z")
Well, my personal preference, which has been listed above would be to reformat. ## Although, an alternative would be, to just ignore her replies. She can’t do anything with the information can she? If your mail server allows it, make a filter so whenever she mails you have it auto-reply something like this: Auto-Reply from [Yahoo.com](http://Yahoo.com) (replace yahoo with your email provider) This email address is no longer active or does not exist, please check your TO: address and verify that it is not incorrect. ## [Yahoo!](http://www.yahoo.com) (replace url with your providers address) She’ll probably send another email to it and see if she really did type in an incorrect address. Soon she’ll come to the conclusion that your account doesn’t really exist or isn’t active. That is if her spyware doesn’t report this page to her, then upon hearing my advise realizes your account does exist… lol :smack: (If you’re using Outlook Express I’m not sure if you can use filters or what not, but you can atleast manually send the error message to her, but you could make it look like it was from your ISP, or if she uses something like yahoo, just give a general email not received error or something like that.) Good luck! 😉 ---
**Author:** ![evilhanz](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@evilhanz](https://boards.straightdope.com/u/evilhanz)\ **Post date:** [August 27, 2002, 2:43am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/33 "2002-08-27T02:43:20Z")
After you’ve removed the program, you might want to have some healthy revenge on your EX by “faking” a couple of the reports. I’m sure your fertile imagination can conjure up a few legal ideas - screen caps of letters to and from the FBI for example, or a protection order or something. Keep up the ruse as long as you amuses you. ---
**Author:** ![postcards](https://avatars.discourse-cdn.com/v4/letter/p/8e8cbc/32.png) [@postcards](https://boards.straightdope.com/u/postcards)\ **Post date:** [August 27, 2002, 3:31am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/34 "2002-08-27T03:31:38Z")
Can you afford a new computer? Seriously, it may be the best (and final) way to put this to rest. ---
**Author:** ![Monster104](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@Monster104](https://boards.straightdope.com/u/Monster104)\ **Post date:** [August 27, 2002, 4:28am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/35 "2002-08-27T04:28:42Z")
I say you report her (via e-mail, if possible) to the FBI, and make sure a real report makes it to her. Then, hook up with some 1337 hackers and mess with her back! (Note: KIDDING! Format and reinstall…and if you can, get XP) ---
**Author:** ![stpauler](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stpauler](https://boards.straightdope.com/u/stpauler)\ **Post date:** [August 27, 2002, 2:19pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/36 "2002-08-27T14:19:50Z")
Heh. I just thought of something funny (that’s funny in a scary way), She’s probably seeing this whole thread too! ---
**Author:** ![neisha](https://avatars.discourse-cdn.com/v4/letter/n/4bbf92/32.png) [@neisha](https://boards.straightdope.com/u/neisha)\ **Post date:** [August 27, 2002, 4:30pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/37 "2002-08-27T16:30:46Z")
She could have a very unfortunate accident if all else fails. ---
**Author:** ![Rhythmdvl](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Rhythmdvl](https://boards.straightdope.com/u/Rhythmdvl)\ **Post date:** [August 27, 2002, 5:01pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/38 "2002-08-27T17:01:42Z")
Some software won’t be eradicated with a reinstall. For example, I have [Homing Pigeon](http://www.zeasoft.com/index.htm) on my laptop. It sends me an e-mail with tracking information every time the machine is connected to the Internet. It is a small measure of security, but if it gets stolen and used by a run of the mill thief (or stolen and sold by one) there is a chance I’ll get it back. The hidden e-mail feature sounds like it does things very similarly to Specter. From one of the FAQ’s on the Homing Pigeon page: > [@](#): > > \*\* What if the thief tries to reformat my Hard Dive, won’t Homing Pigeon[sup]TM[/sup]get wiped?\*\* > Homing Pigeon[sup]TM[/sup]maintains a copy of itself in RAM and recognizes when the hard drive has been reformatted. It then replaces itself and all required Windows system files on the newly formatted HD so that everything was as it was before the HD reformat. It can do this even if the machine is told to reboot immediately after the reformat. I would imagine as sophisticated as Specter seems, it will have similar methods of reformat protection. I’d hesitate before going through the effort to reformat to make sure doing so will get rid of it. Any more experienced Dopers care to comment? Rhythmdvl ---
**Author:** ![Powers106](https://avatars.discourse-cdn.com/v4/letter/p/c57346/32.png) [@Powers106](https://boards.straightdope.com/u/Powers106)\ **Post date:** [August 27, 2002, 5:08pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/39 "2002-08-27T17:08:47Z")
What do you think her motivation was to send you copies of the reports or even tell you that they existed? I mean, why didn’t she just keep her mouth shut? You’d never even know… I’d say that she’s probably not really interested in the reports, but just likes to see you squirm and make you think twice about everything you do…so, drop all the ideas about trying to get her in trouble and just reformat the HDD or reinstall the OS or whatever option is the easiest and just drop it. Don’t even talk to her about it (or anything else for that matter, you want distance from this girl…). You are playing right into her hands if you don’t! Good luck! ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [August 27, 2002, 6:04pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/40 "2002-08-27T18:04:53Z")
> [@](#): > > \*Originally posted by Rhythmdvl \* > **I would imagine as sophisticated as Specter seems, it will have similar methods of reformat protection. I’d hesitate before going through the effort to reformat to make sure doing so will get rid of it. Any more experienced Dopers care to comment?** Depending on when it loads, the solution might be as simple as starting up the machine with a win98 boot disk and formatting then. If it loads from the boot sector, that’s a little tougher–the only method I can think of that _will_ work is to power off the machine, take the hard drive out, and run a few magnets over it. Better make sure you’ve got that boot disk handy… [Previous page](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628.md?page=1) [Next page](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628.md?page=3)