I played with it more today. Here are more specifics:
It is polluted with fake antivirus, that much I can see. I found PC Mighty Max and Win 7 Security 2013 right off. He also legitimately has McAfee and MS Security Essentials, and has had for some time by the looks of things. However, I can't get rid of anything.
All of his shortcuts now feature the Internet Explorer Icon. Everything. Any attempt to open a working program, even the regedit, results in the View Download Manager pop up (by popup, I mean the full square manager, not the little yellow bar at the bottom), at which point you have to select run or save. Regardless of which selection you choose, or cancelling out of it, nothing works. I can't download any help, I can't access the Net from his PC to locate help (it will actually ask if you want to run or save iexplorer) and I can't put any new files on his PC or run them from a flash. Same thing. The pop up.
Starting in Safe Mode does not help and I can't do a system restore because it asks if I want to run or save that, also.
The best I can tell, this began following some automatic updates to IE on Tuesday night. Getting rid of the updates did not help. There were also two add-ons running without permission that were acquired at the same time as the update. I disabled those. Nothing.
Suspicious entries in the task manager include IGFXTray Module and CTFmon.exe, as well as OpenWithMonitor from PC Mighty Max. Ending those processes also does not help.
I would love to tell you exactly what he was doing when all of this began, but he has a raft of little grandkids under ten and it was messed up when he got home, so it's hard to tell. I can concretely say that his wife logged on between 5:30 and 6 and that the automatic updates were at 5:41. She had all of these issues immediately.
Any advice? I am no tech genius, but I can usually figure out a virus. This one, though, is beyond me. Thank you so much in advance.