Go through the following virus/malware removal steps systematically.
Since your friend allowed his NAV to expire, start by scanning with
either Sysclean (instructions at first link below) or Dave Lipman's
Multi-AV. After your initial scan with either of these first-line
tools, with the laptop disconnected from the Internet and any lans
uninstall the old NAV. Install a full-featured av and apply updates. Do
a thorough scan in Safe Mode with it. Then go through the rest of the
malware removal steps at the first link below.
http://www.elephantboycomputers.com/page2.html#Removing_Malware
http://www.ik-cs.com/multi-av.htm - Dave Lipman's Multi-AV
It can be difficult to clean a badly infested machine. Depending on your
skill level (and please be honest with yourself here), it might be a
better choice for your friend to take his laptop to a professional
computer repair shop (not your local version of BigStoreUSA).
Malke
--
MS-MVP Windows User/Shell
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"