Nothing is going to be 100% effective. As long as the kid has physical access to the machine, no amount of security will work. Anybody with the desire and some ingenuity can get around it. And if this kid is cracking passwords then it sounds like he's already outsmarting his parents.
That being said, on my home computers I use both OpenDNS to filter websites for the entire network, and
K9 Web Protection for the Windows machines. I do this mainly to prevent my kids (or myself when kids are in the room) from accidentally stumbling onto unwanted websites.
Neither solution is 100% effective. And it's often annoying when it blocks websites I know are not inappropriate.
Here's where I get on my parenting soap box and complain about people leaving the nannying to electronics (or the government, or schools, or church, etc.)
1. Teach the kid. If what he's doing is personally (morally, physically, emotionally, etc.) destructive then the parents need to talk to him. Just putting chains around things doesn't solve the problem.
2. He's 18 for crying out loud. If he can't simply follow house rules then rights to the family computer should be revoked. I don't buy into the "removing the computer is not an option" excuse. That's
always an option. If he needs a computer for school work he can go to the library. Or buy his own (and pay for his own internet connection too). He will be out on his own soon enough, then how are his parent's going to prevent him from getting into trouble? (Hint: see #1 above.)
3. No offense to these parents, but it sounds like they need to grow a pair and start being parents. No, I don't know them, but every other parent I know that has come to me with the same concerns is always the type of parent that is afraid to show the "tough love." It's not the fun part of parenting, but sometimes it's got to be done.