Routine visit to mother. She pipes up how her laptop got infected and how someone from Microsoft helped her reinstall Windows. Plumbed through the Firefox cache, found the payload still on the machine. Looks like JavaScript and flash payloads were downloaded after the 'clean' reinstall. Needless to say she is now using a Linux desktop as a stop gap. It has Firefox and she can use Facebook. I don't think she even realises it is Linux.