[mosta]

thanks for the input. I forgot about the whole scripts thing (again, I'm minimally tech competent, so I don't much know how it works but I do remember just going to hacker site and having that set off my anti-virus like crazy). also, he may have logged in from another computer that had a key logger. and as has been said, there are lots of ways he could have compromised his password.

I'm not someone who has much chance of figuring out what happened to him, but I hope he finds someone who does so I can learn from it. So far his gmail password got changed. He got in through a google person and his inbox was deleted but not sent messages and no new sent messages. I told him to email everyone to ask if they got messages. then he found that he was locked out of ebay. but he's not locked out of paypal or wellsfargo or schwab. he had the same (weak) password for most if not all of them. so I'm surprised they only got such low value stuff--no cash.

I told him to change all passwords and if he can't figure out a pwd generator, to type randomly on a page for a dozen or two lines and copy and paste 8 characters as his pwd without typing that. curious to see if anything else develops.