Yeah, the 900-number autodialer scam first showed up a couple of years ago, and dialed a number in the Carribean. People who were connected 24x7 racked up six-figure phone bills! This incarnation shows the "benefits" of a couple of years advancement in virus technology--it's wicked and persistent. I have to admit to a grudging admiration for the technical virtuosity of it...in the abstract.

Sounds like you've done all you reasonably can without going overboard--appropriate paranoia. Watching the browser's important. I hate to tell you, though--my sister's reasonably sharp for a civilian, and she swears she never OKed any download. I believe her, and so I fear this thing found some other avenue into her computer.

This autodialer trojan, and the BadTrans/MagicLantern worm, show how easy it is to make an end-run around supposedly-impregnable technology. The autodialer exploit could be used in a "man-in-the-middle" scheme, to reroute somebody's Net traffic to a bogus ISP for easy monitoring--no physical tap or telltale equipment in the ISP (e.g. Carnivore). The keyboard-intercept worms don't bother trying to break strong encryption, they just intercept the key or password when you type it. With just those two techniques, if you can get a worm on to somebody's computer, you can intercept all their digital communications.

Be afraid...be very afraid.

--Robert