[Blacklight]

One time I got hit with it was when I was playing an Alternate Reality Game "You know those games that make it seem that you stumbled upon some real conspiracy and you get caught up in it, and you go to real fake websites, crack codes, solve mysteries, etc..", anyway, I got an instant message from someone who I thought was a character in the game (And he acted all cryptic like so it really felt like it was part of the game). If I hadn't been playing the game, I would have KNOWN it was a spammer, but his answers were JUST cryptic enough that I thought it was a game character and I clicked the link he sent me before he logged off... BIG mistake.

It went to a site that was some kind of hacked looking website (Which of course is common in Alternate Reality Games). Anyway, next thing I know, my firewall is going off that a program nammed JSDownloader something is trying to download files from some site. Even booted in safe mode with all processes turned off, it made no difference. The virus scanner would find the file, delete it, only to have it come right back when I rebooted. The firewall kept it from functioning though, so it sat there for quite a while, then, I updated my Windows XP to Service Pack 2. And no more JSDownloader. It must have overwritten it when it installed.

Another version I got of it and I don't know how I got it since I don't go to fishy or sketchy sites at all, was a little nastier. The firewall kept it from working and no virus scanner could get rid of it(And I tried SEVERAL). They kept seeing it and claiming they got rid of it, but I'd reboot and it would be right back.
What I had to do was physically go into the windows folder and delete some files there and then delete a whole bunch of registry entries to get rid of it.

Tell him to look up the version of it that he has online on the virus scanner website of whatever virus software you have. There should be instructions there to remove it manually if it keeps coming back on him like it did with me.