I think he has installed some Adware which could cause this. Adware is Everywhere nowerdays.