There's a good chance the student's browser has been hijacked by spyware/adware, particularly assuming that they are using the infamous combination of Windows and Internet Explorer.
Spyware and Adware often do things like changing your homepage and search links to the address of porn sites and although I've not heard of this exact behaviour it does fit their general behaviour.
I'd suggest running Spybot and adaware on the machine to clear anything out.
To prevent these kinds of things happening again I'd recommend that the student use Windows Update regularly and switch to using the FireFox browser.