Thanks to a great comment on my last post by Robert, I do feel the need to clarify things a bit.
To all of us who have found spyware / viruses / malware on our machines:
You have to realise that once you get "owned" on your PC,
it's a lot like getting "owned" in prison, things are never the same,
and you can't "go back".
Once you find spyware, you *have* to repave to be sure you are clean (think back to the time you found out your partner *might* have had crabs, remember burning your clothes and sheets and buying new ones?), and then you need to (thanks Robert), install a hardware and or software firewall, and teach yourself to run as non-admin.
There were some unusual circumstances involved this weekend, and a repave was not an option. I realise that he is probably vulnerable, and there isn't much else we can do about it, so it's a possibility he has chosen to live with.