He told me that he got an AVG nag screen a couple days ago and agreed to an update of some kind and ran it. Ever since the AVG tray icon has been blinking and on restart an "AVG Web Update" started running that just does not look correct. Now Firefox self-installed some kind of AVG protection on everything, the logo is even in the address bar. Instead of the regular blank firefox tab now you get an AVG search tab.
I went to restart the computer and in the bottom right corner just above the clock it said something like "Windows 7, Build number whatever, Not a licensed copy." The computer is a laptop that came from the store with a legit preinstalled copy of Windows 7. After I restarted the computer, that notice is gone.
It looks like a browser hijack to me.