harley:
Hi Harley,the best bet for her to know would be to run the computer in safe mode,install microsoft anti-spyware combined with Norton,it not only will eliminate it but as well,give you the computer #s and ips codes.

In my eyes it sounds like the browsers been hijacked,if you type a comma and you see and extra space then you'll know for sure,if she's using the Telephone as the provider to the internet,she should always automatically close all windows or log of before answering,that's there new way of getting at the system,the old email attachments is another,but these Worms and viruses are expanding as well as getting alot more advanced.

Hope i made some sense and have helped someway.

Mike.