You said he uses IE... it could be some sort of spyware that forcibly installed itself.