Sean, maybe he should back up his info, wipe the HD and reinstall everything.  It is a real pain, but better than having viruses on your PC and stealing your CC info from online purchases.  Anyways, sounds like a nasty virus so it might be the best option.  Who knows what else got put on his machine that he doesn't even know about.  Hopefully he didn't have any rootkits installed on him.

BTW, was he running his computer in admin mode or as an ordinary user at the time?  I heard it's best not to run in admin mode because it gives you a little more security.

WARK!

Thus Spoketh Winterclaw: a blog about a Winterclaw who speaks from time to time.

 

(using Poser Pro 2014 SR3, on 64 bit Win 7, poser units are inches.)