It seems much more likely that the AV exe that he is running is infected.