You know what? It could both, working together. Malware is attempting to redirect,and ZoneAlarm is preventing it. As to his running three scans, how long ago did he update that freeware?
Facebook (his home page in this case) is a classic target of misdirect attacks.
At any rate, he can't get to this website, so he's not seeing any of this. 
I emailed him.
Yeah, when I posted just a minute ago I realized that. I had figured yesterday he was posting from work or a tablet, then I realized he probably just jumped on here with the fluke of ZA Update and kaboom, he's sitting in silence checking his e-mail every five seconds waiting for help. Again, durr. But yeah, it could be both, sure. But it sounded like ZA before factoring in the update fluke, with it... I can't imagine it isn't. If you e-mailed him suggesting a very close look at ZA/disabling (Right click it, alt-ctrl-del task manager end ZA.exe process, uninstall, whatever) as an initial soluttion, I won't bother repeating. If not, I'll toss him one in a bit as well.
