Leo says it's unlikely he has a virus, and it's more likely an email trick to get him to buy something with his phone. He should check his phone bill to be sure he hasn't been billed without him knowing it. He should reset the phone and be careful what he taps on!
To reset the phone, he should go into the security settings and reset it. That'll wipe the phone and reload the OS. He can also leave the Google Play store as his only default app store. Leo also recommends LOOKOUT, which is a free app in that will protect him by scanning anything he taps on.