I don't really know about the first part , the RPC thing.
But if her start page keeps changing back to "www.syspage.com/.." have her download and run hijackthis. just make sure she doesn't delete everything she sees in the log. Have her email the log to you and you post it here or over at spywareinfo's forum.
http://mjc1.com/mirror/hjt/