OK, used housecall on his machine....(it's his anti virus that I can't get into). Found 30 infected files....un cleanable, and it won't let me delete any of them because they are 'in use' so I'm shutting down his until he gets home.