Not a virus per se, but something like a data miner that can grab the username-password cookies from a desktop and send them to someone else. When you contact PG you might want to let him know that it's a good idea to check any accounts that he has stored passwords for, especially online banking, email, etc. If he still has access to them he should change all the important passwords.
