He eventually formatted and reinstalled windows just to be sure.
Its just one file that runs on start up. Go in Safe Mode then use msconfig to find where it is located to delete it. Then run full AV scan but I've not had one yet which has had anything else on there.