If he's using WinXP, he should be signed up for automatic Critical updates to WinXP.

If he has any AntiVirus installed he should be signed up for automatic updates at least of AV signatures.

If the computer is turned on, i.e. is connected to power, even if it's in a sleep or hibernate mode, a scheduling program on his computer probably will be able to "wake up" the computer to check for and receive updates. A "calling home for updates" is one of the fairly frequent causes for a "new connection dial-up" or other network connection when you don't expect one. The "boot" or "re-boot" you're seeing may be part of a normal wakeup, or it may be from the occasional downloads that require a reboot to complete installation of new patches.

In other words, it may be "perfectly normal" even if it does seem the computer has become psychotic, deranged, possessed, or is behaving like a wandering spouse.

With newer "green" computers, the status of "on," "off," "sleeping," and/or "hibernating" are sometimes quite vague (and not all machines use exactly those terms).

Most recent model computers do not have an on/off switch that physically turns off the connection to power. The switch merely tells logic on the machine to act like it's on or off. Provided that the computer itself doesn't have a hard-wired on/off switch, and that it does have "green-capable" BIOS and chipset, WinXP can supply the tricks and gimmicks to use the available "states" that the machine can placed in.

The first place you probably should look is at Start | Settings | Control Panel (or Start | Control Panel if you're set up that way). Find the "Power Options" entry in Control Panel, double click it, and try to figure out exactly what "state" the computer is going to when it appears to have "turned itself off."

Terminology often is "tailored" by the original machine maker, and/or by the BIOS, so it's difficult to say just what to look for; but once you're in there, you probably can figure out at least a little more about what's happening, and whether a nefarious activity should be suspected.

John