Make sure he scrolls down in his hosts file because the latest one i have seen they add a crapload of blank spaces in the top of your host file so when you open it it looks like a blank file but if you scroll down 3 pages you will see all the redirects.
try the cwshredder
http://www.spychecker.com/download/d...wshredder.html
it should clean you up