Hacker Alert

[Galdriel Inglewood]

How do I report an account I KNOW is hacked?   I friend of mine is spamming groups and she would NEVER  do such a thing … 

[Whirly Fizzle]

You could file an abuse report against your friend & explain that you think her account has been compromised.  LL will check it out.
It depends on what your friend is spamming in groups I guess.  If her account is spamming phish links to a fake Marketplace page, she probably got phished herself & her account is now compromised.
If you're a premium account you could use Live Chat to report it.
If your friend is posting phish links then it's pretty certain others have abuse reported it already.

[Lindal Kidd]

Rolig, unless this thread's been edited to remove some stuff I haven't seen, this doesn't sound like ExDepart.

The ExDepart scam occurs completely in world, with no reference to group chat.  You are given, or accept, an offer of a free gift, generally from someone you know.  When you rez the gift, it jumps itself up to about 4,000m and starts sending out offers of a free gift, using your name.  It's annoying, and embarrassing if you fall for it, but not really dangerous.

What Galdriel seems to be describing is where someone you know starts sending out phishing offers in group chat.  Whirly is spot on...it's most likely that the account doing this has been already compromised, most likely from following a similar link.

This is very serious.  Galdriel, if you have some way of contacting your friend outside of SL...Facebook, maybe...you should alert her that her account has probably been stolen.  She should call LL's Fraud Hotline at once...and so should you.  The number is: 800-860-6990

[Galaxy Littlepaws]

LSL scripts can't possibly chat in groups chats or personal IM, so it's not an object. Most likely a victim of phishing like others have mentioned.

[Rolig Loon]

It's not a "hack".That sounds very much like your friend has accidentally picked up an object that has been scripted to spoof her identity, sending out spam messages that appear to be coming from her.  There are several different versions of that script.  It's been around for quite a long time and it's hard to get rid of. I haven't had to do it for a while, but @Whirly Fizzle will probably have the best suggestions about how to deal with it.

[Rolig Loon]

Take a look at https://wiki.firestormviewer.org/exdepart , which describes the spoofing exploit that I was referring to earlier.  I haven't had to deal with it for a while myself, but it is a remarkably persistent griefer device in SL.  I have seen two or three different versions of the script, which does very much the sort of thing that your friend is dealing with.

[Rolig Loon]

10 minutes ago, Lindal Kidd said:

Rolig, unless this thread's been edited to remove some stuff I haven't seen, this doesn't sound like ExDepart.

Oh, I agree that it's not the original ExDepart, but I've seen a couple of lookalikes that riff on the theme.  As a scripter, I am confident that I could write something nasty like myself that if I went over to the dark side.  You and Whirly may well be right, though, so the advice to submit a note to the Fraud Hotline is smart.  It certainly can't hurt.  The OP's friend should know that Linden Lab will respond by freezing her account while they investigate, so she won't have access either.