Isn't there a forgot your PW button somewhere? If not, try this: https://account.login.aol.com/_cqr/opr/opr.psp?

Once you get a new PW, change it to something else other than what it was. That virus most likely gave them your credentials and is sending your friends a bunch of garbage.