I burned three Linux distros for him and I will be mailing them to him to play with.
- PCLINUXOS V0.93 - Really good and we use this on our desktops at home. This is a good live CD for him to play with. The only thing is that CLAMAV is not part of the CD.
- Helix 1.8 - Comes with CLAMAV. It also has a good selection of other tools that you can use for intrusion detection.
- Insert 1.3.8 - Comes with CLAMAV. It also comes with a good selection of tools.
With his latest experience on how little protection you get in Windows he may be more open to suggestions on Linux. If you are still using Windows are are interested in Linux there are a good number of 'live' distros that you can start with that don't need installing on your computer. You just pop the CD in your drive and boot up the machine. As long as you have the CD drive as a bootable device before the hard drive you are good. If you want to see more Linux distros you can try distrowatch.