Thanks, everyone. Mike, gmail did make me do the code-by-phone thing to change my password. So I must have set that up sometime in the long forgotten past. Once in a while, things go right. Chuggerguy, I'm jealous. France is so much more exotic than Texas. :) Here are the logs: Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Database version: v2013.02.06.09 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.13 Susan :: SMITHCORONA [administrator] 2/6/2013 3:55:25 PM mbam-log-2013-02-06 (15-55-25).txt Scan type: Full scan (C:\:) Scan options enabled: Memory : Startup : Registry : File System : Heuristics/Extra : Heuristics/Shuriken : PUP : PUM Scan options disabled: P2P Objects scanned: 343343 Time elapsed: 10 hour(s), 31 minute(s), 12 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 4 C:\Program Files\TOSHIBA\Amazon\MP3.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Program Files\TOSHIBA\Amazon\Shopping.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Program Files\TOSHIBA\Amazon\ShoppingD.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Program Files\TOSHIBA\Amazon\VOD.exe (Trojan.Clicker) -> Quarantined and deleted successfully. (end) SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 02/07/2013 at 09:16 AM Application Version : 5.6.1014 Core Rules Database Version : 9979 Trace Rules Database Version: 7791 Scan type : Complete Scan Total Scan Time : 01:35:17 Operating System Information Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600) Administrator Memory items scanned : 516 Memory threats detected : 0 Registry items scanned : 37287 Registry threats detected : 0 File items scanned : 61768 File threats detected : 325 Adware.Tracking Cookie cdn4.specificclick.net [ C:\DOCUMENTS AND SETTINGS\GLENNA\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JB8JPMNZ ] ...319 cookies clipped... accounts.google.com [ C:\DOCUMENTS AND SETTINGS\SUSAN\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ] Trojan.Agent/Gen-Nullo[Short] C:\SYSTEM VOLUME INFORMATION\_RESTORE(1E452A8B-FF85-46AC-BB2A-069DD62D4A2E)\RP1257\A0101126.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE(1E452A8B-FF85-46AC-BB2A-069DD62D4A2E)\RP1257\A0101127.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE(1E452A8B-FF85-46AC-BB2A-069DD62D4A2E)\RP1257\A0101128.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE(1E452A8B-FF85-46AC-BB2A-069DD62D4A2E)\RP1257\A0101129.EXE I let MWB and SAS delete all they found. What does Trojan.Agent/Gen-Nullo[Short] do? I've found lots of malware removal sites telling people how to get rid of it, but little information on what it does? Could I have acquired it from clicking on an image?

There is a HUGE difference between someone gaining access to your email and your computer being compromised. You haven't provided any evidence that your computer is hacked. You have provided evidence to the contrary since you scanned your computer and didn't find anything. Also, if your computer has been hacked, the hacker probably isn't interested in using anything that is actually on your computer but is interested in using your computer to do other malicious things or monitoring your keystrokes to get passwords to financial accounts. Deleting files on your computer isn't going to prevent any of that (assuming your computer has been hacked). People keep many gigabytes of crap on their computers, hackers aren't going to rummage through all of those files in hopes of finding some valuable morsel. Unless you are a prominent person who is known to have classified documents or something like that on your computer, in which case you might be targeted for the data on your computer.

Sometimes, they use that info to get a phony passport, or even a real one, using someone else's identity. When my daughter was in college, she was asked to represent her school at an international hotel school conference in Switzerland. On the last night, she and friends went out for drinks - she carefully hid her handbag behind the nightstand in her room and took a few dollars in cash with her to a bar. When she returned, her handbag was gone - passport, credit cards, student ID, driver's license, airplane and train tickets, money and the keys to her car left at the Syracuse airport - just EVERYTHING. She called us and we contacted the emergency State Dept number (it was a Sat). The State Dept officer said that some little girl in Eastern Europe would most likely assume her identity to come to the US - that these were "stolen to order" based on physical attributes. And they had an entire "life story" due to having all those other things. It was quite a tedious process to get her home - borrowing money from a girl traveling with her, for train fare to Zurich, having money wired by her then boyfriend, now husband, to be picked up in Zurich (we were in rural ME at the time with the nearest Western Union 2 hrs away in Portland), finding a hotel room and checking in with no ID (bit of a challenge - the Swiss are sticklers for the rules), and then going to the Consulate to get a replacement passport on Monday. Of course, plane tickets had to be changed and penalties paid for at this end, and a duplicate set of car keys FedExed to the the ticket counter in Syracuse so she could drive her car back to Cornell. State had to issue her a temporary license with no photo until she came home for spring break. I can tell you it was a very exhausting process, with much of it having to be done by me at this end! I've often wondered if someone did assume her ID to get into the US. That was a long time ago - 1995.

Someone in my neighborhood had their house on the market. They received a package for someone else at their address. I'm not sure exactly what happened. They may have already moved and just had a neighbor grabbing anything from in front of the house. Anyway, someone unsolicited who didn't appear to be from the neighborhood came to claim the package. The house owner asked for ID and the person left so they called the police. The police said the address was probably being used to claim packages so they would not be traced to the criminal.