In addition to Greg Askew's answer, here are some thoughts.
If the user has this infection following him, it has to be something that is particular to this user's habits or account.
Normally it could be roaming profiles, which you said isn't in use.
To get re-infected, it would imply a dropper of some kind or rootkit-hidden program that is re-downloading software after a cloak; is the user running with elevated privileges? In which case the only way to get rid of the re-infection is to reformat the computer and completely start over, even blowing away the boot sector. If something is cloaked in the background and re-downloading software that is detected, this would wipe it completely.
Otherwise you would have to resort to checking the user's browsing habits. Do you have a proxy system that monitors web browsing activity? Can its logs tell you what sites your user is visiting around the time of the infection? (If the software is being downloaded via http your proxy may also be possibly configured to block the download site, depending on what it is...that can help prevent some re-infection vectors)
Another thought; it's a false positive. Take the executable and upload it to an online virus scanner that tests executables against multiple AV engines and see if it actually triggers most of them. I've had trouble with false positives in the past. Again the proxy server, or a packet sniffer, can help determine if the computer is actually doing something it shouldn't be. Just having an AV trigger an alarm doesn't mean the computer is actually doing anything it shouldn't.
You said the infection is causing the computer to lock up; to me, that's kind of strange, since the goal of most malware today isn't to go out of its way to be detected by making the computer outrightly act strange and call attention to itself. Could it be something is corrupting the executable? Could it be coincidence that the machine is locking up?
The reinfection and inability to find a remote install (like the shares or home directory having the infecter) would mean monitoring the user's habits, nuking the install on the workstation and reinstalling from scratch to eliminate hidden kits, and using privilege limits so the user can only "infect" his own directories to which he has access, and verify that the infected executable is really infected by using a third-party website to scan.