Thanks for the replied I have had a look at the PC now, it somehow has Norton reinstalled so she must have clicked something at some point. She also admitted to clicking links from joke emails from friends which I told her not to do in future even if it looks safe.
I have removed admin rights from the User account and created an administrator account to prevent future installations.
Will give it a check with Malwarebytes to see if anything else is present, there were a lot of Java exploits on the PC. I couldn’t find any evidence of the trojan horse, but I had already uninstalled Norton so maybe she had used that to find it.