maybe its something that's affecting your whole server, rather than just your friends site. is he on shared hosting?

one question:

does the website use any kind of form input, querystings or connect to a database without sanatizing the data first?

if the answer is yes then most likely your site has been compromised, if the answer is no then it is the whole shared host machine i expect.

it is easy to find out what the problem is, go to the website (turn javascript off in your browser and active x if using internet explorer) and view the source of the page, see if there is anything suspicious there - especially javascript calling other scripts from remote servers. ... please note this is dangerous and could compromise your own machine

There's a heck of a lot of this going around.

Have your friend contact the host and have them check the site and clean it if necessary.

Might not necessarily be the case here, but many attacks the past year or so have come from keyloggers on local machines, especially the iframe injections. Have your friend do a deep anti-virus scrub and also a deep cleaning with something like malwarebytes.

If you look at a page that Google says is infected, does it have

- iframes
- any unexpected javascript
- src = attributes that reference anything outside your site
- hidden links to malware sites