Has he applied any XP tweaks lately ?

This XP tweak [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisable8dot3NameCreation"=dword:00000001 has been known to cause all kinds of problems with Nortons AV.

Also XP anti-spy this Disable intergrated Windows authentification will prevent Win update from working.

Those two things have done to my XP the things you describe...other than that.....