>>>I just checked google for _eac_qt_ You should too.
>>
>>That's where I started on all of this, did you find something specific you feel we should look at?
>>
>>From what I can see it looks like she had a failed install of Virtumonde, but there are others that seem to use this same extension.
>>
>>She is scanning clean, not showing visible symptoms of an infection and her Hijackthis log looks good. I am currently having her check file extensions to ensure that there is no executable associated with the _eac_qt_ file extension.
>
>I also changed few passwords as well. Will change the rest soon too.
>
>I'm wondering how does everyone remember their passwords?

I use RoboForm:

http://www.roboform.com/

That way each site has a different and hard to crack password.