two people logging on with the same AIM SN

[Force Flow]

A friend of mine believes that someone has gotten ahold of her AIM password. She has changed AIM SNs twice, passwords multiple times, but she still gets the message "your SN is logged on in another place"

In addition to this, someone has been IMing people on her buddy list under her name saying various things she would never say to them.

Her profile settings have also been changed multiple times.

I had her install an encryption certificate and a firewall, but it hasn't solved the problem. any suggestions?

[Force Flow]

Two more things I thought I should add;

She does not log onto any public workstations, only her home computer. She also does not have auto-login enabled; she types in her password.

[DragonNOA1]

Is there anyway you can delete the accounts and then e-mail everyone that those accounts have been deleted. Upon deletion it'll prolly delete the buddy list as well so if that person opens up another account in the same name they won't have any of your friends buddies. As far as someone getting the new password, i would run spyware scans and double check EXACTLY what starts up upon first boot. Good Luck!

[HAL9000]

If somebody is getting in that easily, the passwords are also probably too easy. Make them more complex, alpha-numeric, misspelled are just a few hints.

[SonicVanguard]

I was going to suggest a firewall - thinking that a trojan would certainly give someone the information they need. And it may actually still be in place if she's allowed it access through the firewall. I would have her run Trojan Remover (http://www.simplysup.com/) to see what might be lurking.

Dave.

[Force Flow]

Thanks guys :)

I'll give that trojan remover a try.

No, the passwords aren't easy. They are a mix of letters, numbers and short words.

btw, I spybot and adaware were both run and didn't really pick up anything unusual.