A rootkit can do pretty much anything: it’s got root. There’s no reliable way to detect a rootkit. There are rootkit detectors out there, and some known rootkits do leave signatures, but in principle there’s no reason why a rootkit needs to be detectable at all.
If your boyfriend’s dad uses a computer for work then he had better have been keeping good backups. Many companies also prohibit work-at-home employees from using the computer for any other purpose besides their work. He should be more careful, lest he be fired.
The good news is, re-installing the OS will not affect cloud applications. They run on a remote computer, so they don’t need to be present on the local machine. The bad news is, YES, it does remove all the local programs and data. This is why you need to keep regular backups! (One of the reasons, anyway.)
If the computer has a System Restore point that dates to before he “updated Windows” from the popup, then you might get rid of the problem- but any changes to files (data or programs) that occurred after the time the Restore point was made will be lost.
My advice to you is to quit giving him free tech support. You’re smart and knowledgeable, but not qualified to support this situation (judging by your questions and by the things you said you don’t know.) If you mess up, that could cause bad feelings between you and your boyfriend’s Dad. That sort of thing has been known to happen, and it’s not worth it. He needs to bite the bullet and hire someone- someone qualified and who can provide a guarantee / warranty in case his fixes break something important.
Your Dad also needs to learn how to use a computer properly. He needs to start keeping backups, and he needs to learn to wield the Principle of Least Privilege. At minimum, he needs to stop running as Administrator and stop running untrusted code from the Internet. Windows Updates come from the Windows Update program, nowhere else.
It would be one thing if he only used his computer for playing games and for Web browsing, but he’s using it for work. It was only a matter of time before he ran into this kind of trouble, and using the computer for work can make the consequences more severe. It’s also unfair of him to expect you to bail him out of the situation, at the risk of straining your relationships. (He might not actually have this expectation, but the situation is still a bit fraught.)
So, yes, you need a CD (or some removable media like a USB key) to re-install your OS. If you’re re-installing Windows, you need a CD from Microsoft or from the vendor that sold the machine. For many years new computers came with a CD that had Windows on it along with the necessary hardware drivers to make the machine work. Newer computers often don’t come with these, depending instead on the System Recovery Partition (and, often, leaving customers out to dry). Whatever Windows install media you use needs to have a valid key to type in, in order to show that you’re the legitimate owner of that copy of Windows. Re-installing Windows is not for the faint of heart, nor for anyone who doesn’t know anything about it. If you can get a hold of a legitimate Windows CD, I recommend you practice installing on another computer a few times before doing the procedure on a production system. As always, make a backup FIRST.
Installing Linux is a lot easier, but still not for a first-timer to try on a production system. Once you’ve got it installed, it takes a lot of knowledge to adapt a Linux system for use by a Windows user with an established workflow. I recommend you leave any reinstall operations to a professional.