I just booted it into safe mode, and the error did not occur. He is running windows 7 home premium. If he clicks OK all runs normally afterward.
I've never actually used event viewer before, so I don't know exactly what I am looking at, however there were some errors and warnings in the latest log. It looks like a source called WMI in the application log is giving an error that seems consistent with when I boot the computer. It could also maybe be an error from CVHSVC...but that doesn't look like it's happening every time I boot. (I'm looking under the summary of Administrative events tab...)
As far as changes in software, I'm sure there have been. He's been dealing with this error quite a while now...and I don't know if he'll know when it specifically started occuring...I'll keep you posted though.
In the mean time, does that give you any info to go on?