> Doesn't necessarily mean the site itself is infected. It often means
> that the site is loading an infected ad from a third-party ad server.
> If you are not running ad-blocking software, install some now.

However, te direct jpg link has no html code to load any ads. So whatever spawned something on his PC has to be local on his system, or his proxy adds stuff to pages he try to view.