Maybe you can use windows 7 group policy editor "gpedit.msc" and make it so he can run only specified applications. There's a setting under:

User configuration->Administrative Templates->System->Run only specified Windows applications

You can use stuff like ShowMyPC and remotely add executables to the list if required.

And I think a good free anti-virus software will help as well, I recommend Security Essentials or Avira Antivirus Personal if it's a "buccaneer" version of Windows. Also make a user account for him without administrator privileges. There's also more esoteric stuff like sandboxie or setting up kiosk mode, but I'm not knowledgeable about them.