there is no virus that can do this, it has to be either someone with his password and login, or him.