There are almost certainly many active viruses, worms and Trojans on your friends computer, and probably a whole lot of spyware too. If your friend wants to be 100% sure of removing everything (for example if they do internet shopping or banking or use the computer for confidential business information) the only way to do this is use their rescue disks and reintall the operating system. They should save any files they want to keep before doing this. (And bear in mind the disks might also contain viruses etc., so scan them later before copying back.)
If you and your friend want to try to clean the computer, here is my advice. (I've cleaned a few computers like this recently.)
Download all the programs you need beforehand and run them in this order:
1. Start the computer in safe mode. Try to delete internet temporary files and turn off system restore as these are usually full of malware. Copy Trend Micro Sysclean onto the computer (plus definition files in the same directory) and run it.
2. Copy avast! onto the computer and install. Update from your disk. Schedule a boot time scan when requested.
3. Install TDS-3 onto the computer and copy the definitions file to the program folder. Run a scan. Right click on any nasties it finds and delete.
4. Install Ad-aware, update from your CD and run.
5. Install Spybot S & D, update from your CD and run.
6. Turn on Windows firewall, or install a firewall of your choice and see if you can connect to the internet. Check that your filewall is working at Shields Up! as soon as you get a connection.
7. If you get a connection but your browser doesn't work, run WinsockxpFix.
8. Check carefully for any suspicious activity. avast! Network Shield warnings can indicate a worm active in memory. A lot of internet traffic when you connect can indicate a Trojan is active. Use Process Explorer to check running processes: Malware processes sometimes even have an evil icon when viewed with Process Explorer. (Nice!)
9. If you identify any malware processes still running, a web search may find a removal tool from the likes of F-Secure.
10.Download Webroot Spy Sweeper. Install, update and run.
11. Download MS AntiSpyware. Install update and run.
12. Run HijackThis! and analyse at
http://www.hijackthis.de/index.php. Remove entries which are positively identified as bad.
Edit: At this point, it might be a good time to turn System Restore back on, because you're going to tidy up and update the computer now.
13. Download TuneUp Utilities, install and run a registry check.
14. If everything is working OK, go to the Microsoft update site and install all available updates. (Or order an SP2 CD if there are too many to download.)
If this all seems too technical, ask your friend to spend some time copying the files they want to keep to disk, then flatten the system with the restore CD's.
All the programs mentioned you can find on Google. I'll try to come back and add some links if I have time later.
Good luck.