The horse is already out of the barn. Its too late to lock the door.
what that means is she has been hacked. Only real solution is wipe the unit and install from scatch.
anything less leaves back doors for the spam hacker to get back in again.
HOPEFULL NO FINANCIAL DOCS OR BANKING WAS DONE FROM THIS PC.
if it was call your banks/credit cards immediately and get a watch put on them.
Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's