>>I just checked google for _eac_qt_ You should too.
>
>That's where I started on all of this, did you find something specific you feel we should look at?
>
>From what I can see it looks like she had a failed install of Virtumonde, but there are others that seem to use this same extension.
>
>She is scanning clean, not showing visible symptoms of an infection and her Hijackthis log looks good. I am currently having her check file extensions to ensure that there is no executable associated with the _eac_qt_ file extension.

I also changed few passwords as well. Will change the rest soon too.

I'm wondering how does everyone remember their passwords?