A virus scan is useless. I have experience with keyloggers, crypters, rats, etc. All he needs is an FUD Crypter (fully undetectable). It can be bought for around 15$, and it will pass every single virus scan. The best thing you can do is run your programs in a sandbox, which isolates the program so that it can't infect your entire computer.