SurvivingInfidelity.com Forums
General
User Topic: WH spying on me?
Atticus13
New Member
Member # 39630
Default  Posted: 9:41 AM, July 4th (Thursday)

An odd thing happened yesterday and I'm still trying to figure it out. WH and I had an email exchange about divorce logistics...some info my attorney needs for the settlement. Conversations are typically civil between us, but at the tail end of our our exchange I had a moment and let a few sarcastic comments fly (don't regret those by the way).

Here's the odd thing: later that night when I checked my email that exchange had been deleted. At first I thought I must have accidentally deleted it, but I know I didn't. I never touched the "trash" button. I'm starting to suspect he put spyware on my computer to access my email and files...he used to use my laptop when we were together, and when the s**t hit the fan between us, I was away from home for a week and my computer was at home. I'm running a scan right now, but I don't know if it will pick up the presence of spyware. Anyone dealt with this? How did you get it off your computer?


Posts: 11 | Registered: Jun 2013 | From: CA
Jennifer99
Member
Member # 39551
Default  Posted: 9:45 AM, July 4th (Thursday)

OMG I swear its like everything I went through/am going through is already on SI somewhere!

I had this same thought. My school laptop - I don't know how to tell. I'll be watching the thread.

I wouldn't really care except that is the laptop I pay bills with and he'd get account info.


Posts: 556 | Registered: Jun 2013
Jospehine85
Member
Member # 35971
Default  Posted: 10:10 AM, July 4th (Thursday)

Change all of your passwords.


Me - BS 40s
WH - 50s
4 Kids
Dday May 2012

Posts: 859 | Registered: Jun 2012
Atticus13
New Member
Member # 39630
Default  Posted: 10:12 AM, July 4th (Thursday)

That's what's making me suspicious. I did change my passwords almost immediately after DDay. If there is spyware on my computer, he can see the keystrokes and would know the new passwords no matter how many times I change them.

Posts: 11 | Registered: Jun 2013 | From: CA
GabyBaby
Member
Member # 26928
Default  Posted: 10:12 AM, July 4th (Thursday)

Change all of your passwords.
This wont matter if you truly believe that there is spyware on your computer. Your WH will simply use the keylogger to get your updated passwords.
You should take the computer in to the Geek Squad or some other computer repair place. Tell them that you suspect there's spyware on your computer and you'd like it removed.
THEN change all your passwords once you get it back.


Me - 40s
SorryInSac - WH#2 - 40s. DDay 7/12/14
Married 4, together 7yrs total
Status - ??

DD(21), DS(18, PDD-NOS)
6 Furkids - 4 dogs, 2 cats

WXH (serial cheater, 12+ OW)
Legally married 18yrs, together 16.5yrs

I edit often for clarity.


Posts: 6460 | Registered: Dec 2009 | From: California
Jennifer99
Member
Member # 39551
Default  Posted: 10:18 AM, July 4th (Thursday)

This wont matter if you truly believe that there is spyware on your computer. Your WH will simply use the keylogger to get your updated passwords.
You should take the computer in to the Geek Squad or some other computer repair place. Tell them that you suspect there's spyware on your computer and you'd like it removed.
THEN change all your passwords once you get it back.

For what that would cost me I could just give my laptop to a homeless person or a 5 year old and let Wh enjoy whatever they are doing on it and buy a new one, it was only $200.

But your answer seems much more reasonable.


Posts: 556 | Registered: Jun 2013
GabyBaby
Member
Member # 26928
Default  Posted: 10:20 AM, July 4th (Thursday)

You had me at "buy a new one"!
(I love electronics, lol).


Me - 40s
SorryInSac - WH#2 - 40s. DDay 7/12/14
Married 4, together 7yrs total
Status - ??

DD(21), DS(18, PDD-NOS)
6 Furkids - 4 dogs, 2 cats

WXH (serial cheater, 12+ OW)
Legally married 18yrs, together 16.5yrs

I edit often for clarity.


Posts: 6460 | Registered: Dec 2009 | From: California
Jennifer99
Member
Member # 39551
Default  Posted: 10:21 AM, July 4th (Thursday)

Me too :)

Posts: 556 | Registered: Jun 2013
Atticus13
New Member
Member # 39630
Default  Posted: 10:24 AM, July 4th (Thursday)

F**k a duck, I found it. Here's what you do (thanks web geeks!):

Hit the ctrl-alt-delete sequence and bring up the task manager. Under task manager, click the "processes" tab. The processes list will show you all executable files running on your computer. This takes some patience, google the names and read the info associated.

csrss.exe is running on my computer and is helpfully described as such:

csrss.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

How much lower can he stoop?


Posts: 11 | Registered: Jun 2013 | From: CA
Jennifer99
Member
Member # 39551
Default  Posted: 10:28 AM, July 4th (Thursday)

EW!

Can you save that? Can you quarantine it but not remove it? Leave it be for evidence or something!

No joking - I had a friend who was NOT having an A, her H thought she was, he went seriously over the edge/bonkers. They physically separated and he was doing stuff like that, when she busted him he had all her email contacts and was sending all kinds of people really gross messages that looked like they were from her, etc.

She had to go round with the PD about it.

Now she's with a new guy.


Posts: 556 | Registered: Jun 2013
Getting to Happy
Member
Member # 35200
Default  Posted: 10:41 AM, July 4th (Thursday)

How much lower can he stoop?

Good Lord!!! It boggles the mind that this person was your intimate partner...UGH!

This really lets you know what he thinks of you. Like Chattel.

I am so sorry that you are going through this crap fest.

He has once again showed you who he really is. Please believe him.

Run Forrest, RUN.

As far as keeping this trojan on your laptop for evidence, maybe you can take a screen shot before you dump the .exe...? The pdf that you make of the screen shot will automatically have a time stamp and show what computer it originated from.

Take care.


WS him
BS me DD's 26, 25' DS 23
dd1 1-1-10, dd2 Mothers Day 2011, dd3 3-12-12 Hawaii trip with ho-worker...

Never forget what is worth remembering or remember what is best forgotten.
Unknown


Posts: 1140 | Registered: Apr 2012 | From: La La Land
gonnabe2016
Member
Member # 34823
Default  Posted: 10:49 AM, July 4th (Thursday)

Now that you know it's there, perhaps you can think of a way to use it to your advantage?


"Oh, what a tangled web we weave when first we practice to deceive." - Sir Walter Scott

In my effort to be *concise*, I often come off as blunt and harsh. Sorry, don't mean to be offensive.


Posts: 8034 | Registered: Feb 2012 | From: Midwest
Take2
Member
Member # 23890
Default  Posted: 11:00 AM, July 4th (Thursday)

If it is a keystroke logger - he knows you found it right...? Shame - cause you could mess with him...

Ugh! Just realized that means he knows your user name and password here too I assume.

Think he went further... your phone too? So sorry Atticus.


"We must be willing to get rid of the life we've planned, so as to have the life that is waiting for us." Joseph Campbell...So, If fear was not a factor - what would you do?

Posts: 4113 | Registered: May 2009 | From: New England
Atticus13
New Member
Member # 39630
Default  Posted: 11:16 AM, July 4th (Thursday)

Coming to you from my iPad now....I got a new phone as we were separating he has never touched, so that should be OK. Just shut down the computer and changed all my passwords through my phone, so hopefully no keystroke monitoring there. So yup, he likely knows everything I've been communicating for the past two months. Fortunately most conversations about him have been offline, but he would see what I'm saying to my attorney. Well, glad I figured it out now and was suspicious of that email ending up in the trash. He's making it easier day by day to be happy to be rid of him.

Posts: 11 | Registered: Jun 2013 | From: CA
inconnu
Member
Member # 24518
Default  Posted: 11:34 AM, July 4th (Thursday)

more about csrss.exe - http://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/csrssexe/26bba20c-2691-4d42-bec4-637436c53c4f


Say what you wanna say and let the words fall out...honestly
I wanna see you be brave

Pretty pretty please, don't you ever ever feel
Like you're less than, less than perfect


Posts: 12151 | Registered: Jun 2009 | From: TX
happierdays
Member
Member # 38537
Default  Posted: 4:53 PM, July 4th (Thursday)

Maybe you should type up a little something for him to read via the keystrokes, may I suggest 'screw you dumbass'!

Glad you found it, but sorry you're having to deal with his crap.


Me - 40
WH - 41
Dday - Oct 7, 2012
Dday 2 - June 4, 2013
Married - 7 years
1 DD

Posts: 145 | Registered: Feb 2013 | From: Canada
sisoon
Member
Member # 31240
Default  Posted: 5:31 PM, July 4th (Thursday)

This could be a virus, but csrss.exe from Microsoft is an essential system service, especially if it's running from the Windows/System32 folder. See http://www.neuber.com/taskmanager/process/csrss.exe.html, for example.

inconnu's reference says essentially the same thing, but I think this needs to be stated explicitly here, since not everybody will actually check out the link.

When you think your PC has been compromised, I recommend using housecall.trendmicro.com to scan and fix your PC, since some malware hides itself from the scanner on your PC. With Housecall, the scanning software runs on Trend Micro's site, and that's a lot more secure than any web-connected PC.


fBH (me) - 70 (22 in my head), fWW (plainsong) - 65+, Married 45+, together since 1965
DDay - 12/2010
Recovered, not yet fully R'ed
I share my own experience because it's the only experience I know, not because I'm a good model.

Posts: 10167 | Registered: Feb 2011 | From: Chicago area
Nature_Girl
Member
Member # 32554
Default  Posted: 5:43 PM, July 4th (Thursday)

I found two csrss.exe running in my Task Manager. I'm still okay?


Me = BS (Stay-at-home-mom)
Him = EX-d out (abusive troglodyte NPD SA)
3 tween-aged kids
Together 20 years
D-Day: Memorial Weekend 2011
2013 - I DIVORCED HIM, I'M FREE!
http://www.youtube.com/watch?v=RBOJpIwF47Y

Posts: 9715 | Registered: Jun 2011 | From: USA
aesir
Member
Member # 17210
Default  Posted: 5:57 PM, July 4th (Thursday)

I found two csrss.exe running in my Task Manager. I'm still okay?

Depends... maybe maybe not.

The first thing you should check when looking for this kind of thing is the exceptions list for you installed AV program. Little secret, but when people install keyloggers legitimately, they have to notify the AV software that it is supposed to be there so it will be ignored.

After that, try downloading things like Spybot S&D, Malware Bytes, running those, and perhaps a battery of the free online scanners as well.

Now here is where I don't want to alarm you, but you should also check your router to see what other devices are connected to it. Someone could use a packet sniffer on one computer to watch the internet traffic on another if they are connected to the same router.


Your mileage may vary... in accordance with the prophecy.

Do not back up. Severe tire damage.


Posts: 14924 | Registered: Nov 2007 | From: Winnipeg
hatetheworld
New Member
Member # 37494
Default  Posted: 6:21 PM, July 4th (Thursday)

S**t taco! I found it on my computer too!

WTF!


Me- 23
WS- 26
3 children- 6, 5, 2 (one of which is autistic)
Married almost 7 years in October...
Dday- 11/10/12
Dday 2- 7/2/13 And I'm OUT! It's Divorce time!


Posts: 43 | Registered: Nov 2012 | From: wish I knew
Atticus13
New Member
Member # 39630
Default  Posted: 6:44 PM, July 4th (Thursday)

As other posts and the links have indicated, there is a legit version of the process and a potentially viral version of it. My computer has two, so I'm not sure if both or only one is legit. The only way to know is to scan and look into it. I think the best comment made is if you have seen odd activity as I did that points to something being potentially compromised, check out the computer thoroughly. Unfortunately, there are many tricky ways to manipulate the flow of information on a computer to another computer, email address, etc, etc. I'm checking out my router next...might just replace it to be safe. My WH's father is a computer programmer so my WH has a bit of leg up on me if he did in fact do something sneaky to my electronics....my best advice is if you feel there is something wrong, check it out. But don't panic if you just see the csrss on your computer and haven't been aware of any odd activity. I've noticed quite a bit of odd activity once I started thinking about it, so it's worth looking into all the potential sources...

Posts: 11 | Registered: Jun 2013 | From: CA
k8la
Member
Member # 38408
Default  Posted: 9:08 PM, July 4th (Thursday)

Most Spyware programs that my son is aware of do not show up in the task manager... Just saying.

Posts: 157 | Registered: Feb 2013
Chicky
Member
Member # 18622
Default  Posted: 10:16 PM, July 4th (Thursday)

^^True.^^

That's why 3rd party spyware has a stealth mode.


Half of the truth is a WHOLE lie.

Posts: 550 | Registered: Mar 2008 | From: Somewhere Over The Rainbow
Bluebird26
Member
Member # 36445
Default  Posted: 4:17 AM, July 6th (Saturday)

I am sorry you are finding this. My exwh used to hack into my emails as well. I found the same thing an email deleted. But I tricked him into admitting via email he was hacking into my emails, just in case I ever need it for court. My exwh is a computer tech I would go out and buy a new laptop/computer if you can afford too just to be sure or if you are tech savvy reset it to the original factory settings or take it to a professional to do.

Funny thing is my exwh promised me he would still look after my computers I would sooner pay someone else to do it. Goodluck.

[This message edited by Bluebird26 at 4:18 AM, July 6th (Saturday)]


"Loving someone should not mean losing you. Love empowers you. It shouldn't erase you. - Thelma Davis.

Posts: 1348 | Registered: Aug 2012 | From: Australia
Topic Posts: 24