The big unknown adventure with no clicks involved, just happened, ooops... Ok I stop but details, details, the more the better. Must know what went wrong, can nearly always be found out. If he has given you detailed and convincing reports of infection he also know where it came from. Check Malwarebytes log if nothing else is avialable, PM me link and such if you have it please. May be he got hit but Im sure of one thing - he DID click and that will be confirmed by a reconstruction. Most conveniently forget but unless you run unpatched XP with IE6, a few old browser plugins will help too, chances are not so clever clicks are involved. Like every time. Nothing to do with MSE, should stop whatever anyway but MSE was not alone of failure or you can slap me silly. If an infection race through your knowledgeable friends supposedly fully functional setup we have a major history to tell the world. Closest you will get to I did not do anything!! is infection from an usb drive with autorun enabled. That is entirely up to scanner and Windows to stop. He cant do much about that. I think MS just released a tool to permanently disable autorun on all removable drives, not the worst idea if unknown drives are used.
Well seems like that MS was right about that Russian update.exe which is in fact notepad.exe. I guess malware collector must have bundled it with all the other nasty Flash exploits and exe-files on that site. First time Ive seen that. Comodo now also flag it but I dont know. 3 out of 40+ I or scanners cant see any sign of infection so give up, is just sitting there. Went through strings in Process Explorer, looks like a Russian notepad to me. Had hoped it would trigger suddenly, nothing happens. Besides apparently being right response time of 16 min. is extremely fast. Makes people submit more, less than 6 hours or so is great.
Does not take more than a Google search do find those lists of malware but if anyone wants the handful I have they are avail. Next after Vista/7 getting computer infected is the most effective defense ever. Spend time removing too. Also good test of browser filters, Ive been told by MS IE8 have a 80+% detect rate in "social engineered" malware downloads = links! Try 30 tops. Strange world this is. Goes a bit up and down because those site of course does not list in real time, bundle and present. How that match MS filter machinery is perhaps random, no where near 80% hitrate that is for sure. Not ahead of Google filter either but nm that, another battle... If infection is good, like you cant figure out how to remove - done for!, it will stick in memory for a while. Must be done in Virtualbox/VMware or what else there is. No shared folders either. Get a 120 days free XP with IE6 from MS if none available. MSE require legit Windows, I assume it will work on those free versions. Guess easiest to set up in MS Virtual PC, don't remember if Virtualbox convert automatically.