It's probably sending your passwords to someone or another program that logs onto your account and gets the address book. If you already have avg I suggest www.malwarebytes.org to be run in safe mode.
--
If you become a monster to put down a monster you've still got a monster running around at the end of the day and have as such not really solved the whole monster problem at all.
--
If you become a monster to put down a monster you've still got a monster running around at the end of the day and have as such not really solved the whole monster problem at all.