Couple of thoughts about this:

Number 1, don't just log off; disconnect the computer physically from the phone line, cable, or whatever but leave the computer running.   Does the flashing stop? If so, it sounds like it was caused by something from the web.

You say he "can't get to" his Norton's. What does that mean? He might want to contact Symantec's support function.

I also know that some versions (if not all) of Windows continually do things in the background, even when there's no keyboard or web input, and no programs (other than the operating system) running. Frankly, that's my guess in this case.

You say his D drive is almost full.   I don't know what that means. What is "C:" assigned to? I believe in most people's setup C: would be what I'd call the default main drive. and D:, if present, is not a system drive.

I once, back in the Pleistocene era or thereabouts, had a setup where C: was merely a partition on the hard drive where the operating system resided, and everything of content was on D: or subsequent partitions.

In any case, it could be that the operating system is frustrated by the crowded conditions on the D: drive, and keeps trying to do housekeeping operations and can't do it.

In any case, if his HD is overcrowded he'd better engage in a major elimination program, or compress files, or get a new hard drive to either add to or replace the overcrowded D:.

Dave Oesterreich