Not being funny but can you be sure its the PC and not the user?
Seem this a few times and its usually down to the user dragging and dropping files or folders and making copies. Sometimes slow clicking the mouse can cause it to happen as the user might move the mouse between clicks. Also if the mouse has a a ball then if its dirty it could slip between clicks and produce a drag and drop copy...
To be honest, I have no idea if things, such as the mirror virus are still around. I cannot imagine how it would infect a 98 machine, but then I suppose Win 98 is DOS based. I am talking about a virus from the early 90's, so I would imagine if it infects Windows any half decent virus scanner would protect against it.
Does your friend have Spyware protection running such as Spwareblaster from click here It's a free program that if kept up to date stops any & all Spyware from infecting your machine. I use it & have never had a problem.