# EX from hell spying on me **URL:** \ **Category:** Factual Questions\ **Created:** [August 26, 2002, 2:41pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628 "2002-08-26T14:41:54Z")\ **Posts on this page:** 12\ **Page:** 3
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [August 27, 2002, 6:13pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/41 "2002-08-27T18:13:14Z")
> [@](#): > > \*Originally posted by Rhythmdvl \* > **I would imagine as sophisticated as Specter seems, it will have similar methods of reformat protection. I’d hesitate before going through the effort to reformat to make sure doing so will get rid of it. Any more experienced Dopers care to comment?** Depending on when it loads, the solution might be as simple as starting up the machine with a win98 boot disk and formatting then. If it loads from the boot sector, that’s a little tougher–the only method I can think of that _will_ work is to power off the machine, take the hard drive out, and run a few magnets over it. Better make sure you’ve got that boot disk handy… ---
**Author:** ![Jdeforrest](https://avatars.discourse-cdn.com/v4/letter/j/49beb7/32.png) [@Jdeforrest](https://boards.straightdope.com/u/Jdeforrest)\ **Post date:** [August 27, 2002, 6:18pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/42 "2002-08-27T18:18:23Z")
Couldn’t you repartition, turn off the machine, start with a boot disk, format the mbr, then format the drive? Don’t have that much experience with boot sectors. ---
**Author:** ![Khadaji](https://avatars.discourse-cdn.com/v4/letter/k/9e8a1a/32.png) [@Khadaji](https://boards.straightdope.com/u/Khadaji)\ **Post date:** [August 27, 2002, 8:34pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/43 "2002-08-27T20:34:03Z")
run MSCONFIG and turn off all suspicious looking programs. Be careful here, there are some things that you just shouldn’t loose. If you know a computer guru, have him look over your shoulder. ---
**Author:** ![toker420](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@toker420](https://boards.straightdope.com/u/toker420)\ **Post date:** [August 27, 2002, 9:21pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/44 "2002-08-27T21:21:57Z")
Do not reformat, you dont have to. Heres what you do. : Go to Start, programs , Accessories , System tools, and click on system information. Wait a few minutes for that to load. once it loads, on the gray toolbar area. Click on Tools. Scroll down and click on System Configuration Utility. AT the top in the grey Tabs, click on STartup. SEe if u have any suspicious files there. So look through the and post back here with wh at you have there. In the mean time, do what a previous post said and get Zone Alarm. The first time you run it, it will ask what programs you want to access the internet, and when your email program or whatever tries to send the information just disable it and it cant send it out. You will have to do the same with Internet Exporer and all your other progs. But once you get the name of the program from zonealarm or u find it by other means, then you can delete the crucial exe files and even if u dont delete every registry setting it will be pretty much disabled without the important exes. ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [August 27, 2002, 9:25pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/45 "2002-08-27T21:25:31Z")
> [@](#): > > \*Originally posted by stpauler \* > \*\*Spector is perhaps the most powerful and common spyware. It adds several files to the C:\Windows\System directory, including mswnsrvx.cnt, mswnsrvx.exe, mswnsrvx.hlp, shmswnmp.dll, and shmswnrc.dll (all of these are hidden files). The easiest way to determine whether you are under surveillance by Spector is to check for the C:\Windows\System\WebExt directory, which contains files with names like “4F0BF6D8.TPS.” There may also be a master log file called “\_MSFILEA.TXT”, which shows when each capture file starts. The WebExt directory isn’t hidden, but it can be changed to another name to make it harder to detect. > > ``` > EBlaster is recognizable by its main program file, which is 468KB URLMKPL.DLL, in the Windows/System folder. Also added are msskfzwin.dll, msskfzwin.ocx, and winmsskfzwin.drv. EBlaster must send e-mail outbound to report on you. Severing your network connection will only cause reporting to be delayed. ** > > ``` The information needed to disable this program seems to be right here. Look for urlmkpl.dll (it’ll probably be hidden), and if it’s 468K, delete it–you may have to go out to DOS to do so, but that should work. ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [August 27, 2002, 9:25pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/46 "2002-08-27T21:25:31Z")
> [@](#): > > \*Originally posted by stpauler \* > \*\*Spector is perhaps the most powerful and common spyware. It adds several files to the C:\Windows\System directory, including mswnsrvx.cnt, mswnsrvx.exe, mswnsrvx.hlp, shmswnmp.dll, and shmswnrc.dll (all of these are hidden files). The easiest way to determine whether you are under surveillance by Spector is to check for the C:\Windows\System\WebExt directory, which contains files with names like “4F0BF6D8.TPS.” There may also be a master log file called “\_MSFILEA.TXT”, which shows when each capture file starts. The WebExt directory isn’t hidden, but it can be changed to another name to make it harder to detect. > > ``` > EBlaster is recognizable by its main program file, which is 468KB URLMKPL.DLL, in the Windows/System folder. Also added are msskfzwin.dll, msskfzwin.ocx, and winmsskfzwin.drv. EBlaster must send e-mail outbound to report on you. Severing your network connection will only cause reporting to be delayed. ** > > ``` The information needed to disable this program seems to be right here. Look for urlmkpl.dll (it’ll probably be hidden), and if it’s 468K, delete it–you may have to go out to DOS to do so, but that should work. ---
**Author:** ![fatmac98](https://avatars.discourse-cdn.com/v4/letter/f/3ec8ea/32.png) [@fatmac98](https://boards.straightdope.com/u/fatmac98)\ **Post date:** [August 29, 2002, 3:32pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/47 "2002-08-29T15:32:58Z")
Now the whole orld know about this. http://www.msnbc.com/news/800409.asp If this is not illegal it sure as hell should be. ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [August 29, 2002, 3:36pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/48 "2002-08-29T15:36:52Z")
Fixed link: [http://www.msnbc.com/news/800409.asp](http://www.msnbc.com/news/800409.asp) There are cases where a program like this is useful. Corporations have the legal right to monitor their employees internet usage, and they should be able to use this legally. ---
**Author:** ![Islander](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@Islander](https://boards.straightdope.com/u/Islander)\ **Post date:** [August 30, 2002, 1:25pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/49 "2002-08-30T13:25:43Z")
Reformat and reinstall are good methods, but that does not complete the security process. There is a 3rd “R”. Rotate your network interface card or modem. Even if you wipe your hard drive, your mac address to your PC will always be there and if that spyware program has a record of your mac address (aka physical address) on its database. Your PC can still be “reacquired”. Your NIC or modem contains a permanent mac address that can never be altered. For $40 or less you could get another NIC or modem. If you really want to get fancy, for $120 or less you could slap on a physical firewall router and your default mac address will be 00-00-00-00-00-00. Here are the steps to follow to obtain near perfect anonimity: 1. Reformat and Reinstall 2. Rotate weekly of NIC/modem cards 3. Install Zonelab firewall 4. Install firewall router 5. Set IP address to dynamic(DHCP) settings These steps should make you virtually invisble online. I would not suggest you do this on a PC at work, you would have problems getting any connectivity. If you are running fast internet connectivity ie. cable internet, you will have to contact your ISP and let them know that you are swapping your NIC so that you can retain connectivity. Gotta wear a helmet riding that info highway. ---
**Author:** ![susherrie](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@susherrie](https://boards.straightdope.com/u/susherrie)\ **Post date:** [November 4, 2002, 8:55am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/50 "2002-11-04T08:55:36Z")
hey guys check the LadyG threads this may answer all your questions about this jerk, and his ex. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [November 4, 2002, 11:40am UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/51 "2002-11-04T11:40:26Z")
Actually, you can alter the MAC address on a NIC. I’ve never done it, but it can be done. Just make sure you change it to something that is unique on your subnet. ---
**Author:** ![Bongmaster](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@Bongmaster](https://boards.straightdope.com/u/Bongmaster)\ **Post date:** [November 4, 2002, 5:13pm UTC](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628/52 "2002-11-04T17:13:35Z")
> [@](#): > > \*Originally posted by Hodge \* > \*\*I’m going to reiterate what a few others have said: > > **Reformat and reinstall** > > If you don’t have the technical chops to do it, then learn. There could be all sorts of other crap installed that you don’t know about. And then you might consider informing the police of ex’s behaviour. What she’s doing is definitely against the law. \*\* I have to totally agree here. Unless you are really good with PC operating systems the esiest way to make certain it is gone is to wipe it all out and start over. That sounds like a pain, but is a better alternative than wondering if you really got it all. [Previous page](https://boards.straightdope.com/t/ex-from-hell-spying-on-me/125628.md?page=2)