I had him download Malwarebytes and run it. Seems to have cleaned up the problem.
I suggested he purchase this since this is a recurring problem. They are probably getting this malware from a bad email.
In any case Malwarebytes solved the problem.

Regards,
Dan Kahn