Friend sending spam with links to .../cool01.11.php

My friend’s computer is sending emails with links to random urls that always have …/cool01.11.php in the link.

Some examples minus the http://www. are correodominicano.com/cool01.11.php?ID=531 and duchesne.nerim.net/cool01.11.php?SID=478

He runs Avast! Free and it still happens. Any suggestions I should give him?

Thanks in advance.

have you done a check with Malwarebytes ?

Malwarebytes Anti-Malware 1.50.1 http://filehippo.com/download_malwarebytes_anti_malware/
always update so you have latest database before you scan
click the remove selected button to quarantine anything found

If anything is found you can post/attach the scan log here

Thanks. I’ll pass the word and we’ll see what happens.