there are redirect fixing utilities that can assist with that.
the first thing to check would be his HOSTS files , which can have IP redirections, and DNS, the dns that is used to turn names into IP numbers. Any proxies that are in play.
if the hosts file has names and numbers in it , that are set to point to the evil locations, this would redirect behind the scenes the users requests.
open up the HOSTS file that is found on the computer (actually any of them to be sure) , and observe the contents of it.
If the Server that is resolving names into numbers the "DNS server" being used by the connection the users names are resolved out to evil addresses that the DNS resolver sends it to.
Check the users Advanced properties in the network connection device, for the DNS and WINS and all that good stuff.
If there is a "proxy" applied anywhere in the system, be that in the internet options for the browser , or a program that is intercepting.
that was the browser ONLY.
the next part, is beyond my skill, the manipulation of the systems exe capability or blocking of specific applications to keep the situation from being resolved via virus protection software.
If the virus is lame enough, you can rename the extention of a virus checking tool to .com , sounds really weird to do that. .com files can be executed by the win98 and XP systems, dont know about vista and 7 yet.
this cheap trick would allow you to manually startup sometimg like Malware bytes (as tested) , and then you have some capability to proceed.
again beyond my skill, even if that worked, you still would have other things to have to do and check, and refer to more expert advice on the subject.