A Squared, Windows Defender and Zone Alarm should be on that list. You can install them from a CD, no problem there, but of course you won't be able to download the latest definitions if you can't go online. Still, you should be able to get rid of most of the rubbish without the latest definitions, though presumably your friend's Windows installation is hopelessly unpatched too? You can slipstream Windows Updates - I suppose you could start with SP2 and slipstream all the updates since then, but doing that will keep you busy for a while.
Once you've finished with your friend's machine, I suggest you tie him to the desk and forcibly give him a lesson in updating and running scans and then extract a promise on pain of death or denial of beer that they will do that religiously.
If it's really bad you might just want to format the HDD and do a clean install. Good luck.