[Too]

* Set a password on UAC (windows sudo equivalent) and teach him that if the background ever goes black and asks for a password he should be very aware. The default is just a yes/no popup and is very easy to just click yes, even accidentally for tech savy users. For extra protection, don't give him the password.

* Remove the anti virus and tell him that you did so. It just gives a false sense of security and introduces more popups which teaches users to ignore prompts. If he knows it's not there he might be more careful.

* Install ublock origin. It blocks known badware domains and reduces the amount of clutter/ads on almost every web page you browse, making it easier for him to identify weird stuff.