<< he said his virus scan did nothing. >>
I am assuming that it is upto date?
Wscripts is part of Windows Scripting Host, and while there is lots of good uses for it, virus seem to be the most popular choice
Another option (long shot) is that he may have a form of ad-wares installed that uses scripting, try getting ad-wares and the latest update list and run that.
Finally he may be running extentions to IE or Outlook (or anything) that are scripts and need wscripts, odd but possable.