Google some of the text in the emails it's sending. Might lead you to pages on an antivirus web site or other people with same problem.
Never use programs that add emoticons to your email program. These effectively give away your address book to the author of the program.
Perhaps worth checking the email headers to see if her machine is really sending them... or if her address book has been sent to another machine that is pretending to be her.
If Norton can't find it try a free program like AVG or an on-line scanner like Housecall from Trend Micro. Do not use any old free antivirus program without cheching who it's from. There are fake antivirus programs out there.
There is a program called HiJackThis which will generate a comprehensive log of what's running or installed on your PC. However you need an expert to look at that log and tell you what's likely to be the problem and how to remove it. That's because if you blindly remove everything it reports it will mess up your computer.
HiJackThis can be found here..
http://free.antivirus.com/hijackthis/Perhaps post the HiJackThis log here with a brief explanation of the problem...
http://www.security-forums.com/viewforum.php?f=48 Usually they like you to take a step by step approach. eg they may suggest removing something and then posting a new log. Repeating the process if necessary. It's best not make other changes at the same time or post your loge to more than one forum at once.