Keyloggers are not at all illegal in this case, since he only wants to log himself
Windows XP has a built-in event viewer in Control Panel > Computer Management
(or something to that effect). It doesn't record everything, but probably enough to detect spyware/virii, etc.)
A quick Google search
revealed this program: http://www.actualspy.com/
Ooh! Definately try their Process Explorer
as well. It is basically a lot like Windows 2000/XP's built-in task manager, but it has a few extra nifty features including a handy tree-view of running processes.