If you can boot into Safe mode and do a system restore I would try that first. It could be something he Downloaded or a site he visited that loaded something on to his computer that is doing this.