Most probaply he is infected with an rootkit.