malawarebytes has found nothing at all running - wow - wasn't expecting that
going to run it again though in safe mode to be sure
other stuff I've removed though are
gotoassist - thats how he gained access (with owners consent)
advanced system protector
mypcbackup - not spyware, but a bloody nuisance one
as a precaution - she's cancelled her credit card