First of all run that MBA-M again, this time do a FULL SCAN to be safe and have it fix or remove what it finds.
Now you say he "deleted" Norton...did he actually just delete it or was it UNINSTALLED?
Since he no longer has the Norton, or at least at this point that is what we think, you can find that out for sure, I would recommend either Antivir, Avast or AVG 8. All are free and do a good job. All are linked HERE
I will need to see the next MBA-M log, a new HJT log too.