Unhook the internet connection first.
You need to start her computer, hit F8 until the boot menu appears and choose safe mode. Once it's up and running go to start>all programs>accessories>system tools>system restore>settings. In here turn off system restore or else after you're done cleaning you re-infect the computer. Go to add/remove programs in the control panel and remove anything that you you think looks suspect. In safe mode you should be able to run your scans. Scan with at least 2 different programs, 3 if you really want to be safe. There is no one program that catches everything so one is not enough.
Restart and see what happens. Don't forget to turn system restore back on.
