>I just checked google for _eac_qt_ You should too.

That's where I started on all of this, did you find something specific you feel we should look at?

From what I can see it looks like she had a failed install of Virtumonde, but there are others that seem to use this same extension.

She is scanning clean, not showing visible symptoms of an infection and her Hijackthis log looks good. I am currently having her check file extensions to ensure that there is no executable associated with the _eac_qt_ file extension.