he can't even boot it in safe mode??

If he can boot it in safe mode, try booting it safe mode with networking.

if he can boot on safe mode with networking: go here:

http://housecall.trendmicro.com/

run the anti-virus on line for free. See what it finds.

Then,

Download adaware free:

http://www.lavasoftusa.com/products/ad_aware_free.php

update it, unplug it from the net, then run it in safe mode.

after it catches whatever, run it again.


Then,

download superantispyware

http://www.superantispyware.com/

update it, don't run it. See if he can boot back regular

now run super anti-spy

then, run hijackthis from trendmicro. Email me the log file and we'll see if we can scan all the intruders.

My guess is that his computer has been hijacked. And the more likely scenerio is someone was doing some serious person 2 person sharing.

But that's just my guess