User error is always a possibility. David's been around the block with PC's though. It was definitely not a browser-based login according to him. He said the ethernet hooked directly into a can-shaped device in the hotel, that, I assume, tracked his time on the web. This was at the Holiday Inn Lido in Beijing.

He played around with it at first, trying to avoid the login on the purple hotel screen. He said the screen popped up whenever an ethernet cable got plugged in, or if it was plugged in on booting, as I described in my first post. This is an old, old Toshiba with a pcmcia nic which I doubt is bootable, but I'll check the bios.

I searched for any newly installed exe's and dll's and all there was was some Symantec dll's. No exe's. I'm trying to nail him down a bit on dates so as to peruse the logs.