On a non-rooted phone, it's not currently possible to hide applications from the Manage Applications process under Settings, so if there's spyware installed on his phone he should be able to uninstall it easily enough.
(If he's rooted his phone, then he should be familiar enough with its internal workings to solve the problem on his own.)
This isn't true, currently on the market is an app called Sms tracker agent and once you download said app you go to their website and install a cover up/skin app all it does is change the icon and name that appears on the phone to system health. Don't need root and it hides from the launcher.
It will show up I believe in the app store.
There's also a another app that allows remote control of the phone via the computer.
I would recommend him to factory reset and not sync his phone to his Google account until he sees what is on his market place history.