Let him run a boottime scan with Avast. If that doesn’t solve it let him post a HijackThis log here.