He had been infected with the QHOSTS trojan.
We removed the rogue hosts file from windows\help.
We changed the registry to point back to the correct location for the hosts database.
We deleted another registry key.
Details are
here.
------------------
-alan in sitges, home of the new, improved
Si-Re-Do