This is happening to many others at this time. Yahoo suggests you change your password and do a full virus scan immediately. Whether at all possible, you should let your contact know not to click the link, it is a virus. It moves through the files and then wants you to subscribe to a phony virus protection service to get rid of it. They should do a full virus scan also.
this happened to me too!
Someone has your password.