I'm usually pretty careful in regards to what websites I go, no popups, scan for malware regularly etc. I have Yahoo Instant Messenger on at work all the time. I leave for lunch, come back, and notice my YIM is logged out. I log back in, and have 1/2 dozen contacts sending me messages saying "WTF are you talking about?" Evidently, someone logged me out and logged in as me and sent all my contacts a message, MY SPACE YA http://xxx.y-grupo.com/ccount/arquivo.php?download=20 THIS PROGRAM IS PRINT SCREEN BY ME (i modified the link ) The link just goes to a direct download of some executable. I was able to go to my yahoo account and change my password, but I've never given the password out and it doesn't match any password I use for any other site I ever go to. Has anyone heard of attacks like this... is it conceivable that someone did NOT get my password, but found another type of exploit?