How did he get my email password?

The only way to be sure the malware is gone is to reinstall the OS. Depending on how tech savvy your husband is, it may be very difficult to protect yourself from this in the future. You can take basic steps to make sure he can't log in to your machine install key loggers in the first place (use strong passwords), but if he's determined and has physical access to the hard drives, he'll be able to do it anyway. You could also boot from a http://www.ubuntulinux.org/ to do things like browse the web safely, but that's a band-aid remedy. (technological solutions to behavioral problems don't usually work)

A small piece of advice, to save you the trouble of figuring out if he's stopped or not: if he's unwilling to tell you/show you how he was doing it, then he hasn't stopped.

In addition to the people mentioning hardware loggers (and don't forget that a fair amount of email ends up going over the net as plaintext, ripe for sniffing), I think that you have to specifically address the fact that if he's not willing to discuss *how* he did it, then you can have *no* trust that he's not still doing it. He's betrayed your trust, and will have to earn it back. Until then, you can't trust anything he says (I.E. I've stopped reading your email). If he tells you exactly how he did it (If he says it's a physical device, ask to see the device (and then smash it?), so that you know it's not software), only then can you regain some security. If he won't tell you how (and be able to demonstrate), then the only way you can have a hint of security is to move to a new physical location, have your computer hardware thoroughly inspected by a geek, a complete software reinstall, and new passwords (and security questions) and *every* account. And he can never physically be at this new location. Ever. Heck, if you have a wireless network, you can't even let him know where the location is, as he could sniff from outside. Essentially you have to DTMFA unless he is willing to *completely* come clean. What has your counsellor said regarding this? Seriously, I don't see how one could attempt to rebuild a relationship with such a seriously damaged foundation. The foundation *needs* to be redone. Wow, I'm sorry for the situation that you're in.

The only way you can know for sure is to get a new computer. http://ask.metafilter.com/86337/Someones-Watching is probably relevant. (Also, it sounds like you've got bigger problems than computer security. You probably already know that, though.)

You cant. If he has physical access then he has everything. Use a computer at the library.

Clyde Mnestra: saying "there is no good answer within the parameters you give, for the following reason" is an answer, and in my opinion the correct answer to this question. There isn't a good technical solution to what is ultimately a relationship problem, not a technical problem.

Obviously you've got a serious problem in your marriage: your husband doesn't trust you, he is himself deceitful, you're in counseling. Since he get into your accounts in the first place, does it honestly seem realistic that if you approach this as a battle of who can stay ahead of whom technologically, you've got a chance of winning? If you don't root out the basic problem and deal with it decisively, he will likely find another way to spy on you. He has not been willing to tell me how he did it. What justification is there for this, other than A) because he's still doing it or B) so he can do it again at will? Bring that up in counseling. This is not a technological problem. As your relationship stands, as long as you are using a computer he has access to to access the internet through a connection that he manages technologically, it seems really likely that you will be able to secure privacy on your computer.

Um - buy a new computer (laptop, AsusEee) and keep it with you. If he has physical access then there is nothing you can do. While I can sympathize - I have seen the other side of the coin as well - where a friend who simply made a practice of monitoring his network eventually discovered his wife's affair. If you feel safe (ie. that there will not be any abuse if he confronts you) - you can test his monitoring as others have mentioned. Create a fake account somewhere (hotmail, etc.) and use that to send steamy messages to yourself...

DO NOT USE THE GEEK SQUAD. If you dont want your husband snooping around you surely dont want the squad checking out your stuff.