My guess, and it's no more without seeing what was actually posted, is that it's a one-off.
What often (but not always!) happens is that he saw a post on someone else's wall that said, as an example, "Take a look at this video of
**insert famous name** doing
**insert popular pastime**" and clicked on it, thinking it was a straight-forward link.
What he actually clicked was an app which someone had created to look like a link and the app posted something on his wall.
This is one of many reasons to always check the URL (use the hover over facility) before clicking a link.
However, that's purely conjecture and it could be that someone has hacked and picked up his FB credentials. Changing the password is always a good thing to do if in any doubt.
I doubt that it's a virus, it woud be a very specific virus attack which only took over the user's FB account, so there is very little chance (again, IMO) that there's anything to clean from his machine.