Tondah
14
Hello, from my point of view it looks like some malicious page was impersonating google.com in mentioned computer.
It could be either changed “etc/host” file or automatic proxy in web browser, but because avast is not alerting continuously, i would suspect rouge DNS service takes place here.
Is it possible, it happened on different network than his home?