It's possible the Trojan on his computer is redirecting any link he attempts to access in HIS browser to an 'impersonator website' created by the person who made the Trojan.
You will always know if it's the real website or not, take a look in the address bar, and there will be various clues, both in the security certificate icon, and the address itself.
If you are still unsure, run Malwarebytes Anti-malware on your system.