If this is a corporate machine, then the user should not have had the admin rights to install anything, and should not have any data sitting on the (encrypted) machine in any case; furthermore the local antivirus and anti-malware software should also have been active.
In such a case, I would quarantine the machine for "further tests" and proceed to scan the hell out of the local drive to make certain that nothing actually got onto it, whilst making the user cool their heels waiting for this to run. Kicking about for 20 minutes is generally unpleasant enough to get the message about not visiting dodgy sites over to users without actually harming anything.
Biting the hand that feeds IT
