This is a virus called Troj/Bizves-B.
Instruction on deleting it are found here:
http://www.sophos.com/virusinfo/analyses/trojbizvesb.html
Make sure you click on the advanced tab on that page, and clear out the registry entries described there. It sets a regsitry key so that the executable loads when your keepboard profile loads. This is early in the boot process, so it may be undetectable by your anti-virus.
Then download a new webbrowser for your son. Either Firefox or Opera. I use opera myself. Its freeware if you can put up with a banner ad at the top of the browser.