Gatekeeper claims everything is damaged and it cannot be turned off

I'm struggling with a really odd issue here on a good friend's Mac Mini running El Capitan.

He's updated to El Capitan (10.11.1) recently and now he's noticed that he can no longer seem to open any software he downloads from the web.

I'm not sure if this problem has begun with the 10.11.1 update, with El Capitan or maybe even before.

Here's what happens:

1. No matter what software he downloads from the web (most of it not signed by the developer), Gatekeeper will behave as if the downloaded applications have been altered, reporting them as damaged and only offering to move them to the trash. This happens with downloads that are perfectly normal unsigned applications and on other Macs I can open them via right-click open and confirming that I want to despite being unsigned.

2. When checking in System Preferences > Security & Privacy > General, Gatekeeper is set to allow "Mac App store and identified developers". I can change this to "Anywhere" and confirm, yet if I close System Preferences and then open it again, it's returned to "Mac App store and identified developers". It will not turn off, no matter what.

Tried so far:

-Restarting, just in case

-Reinstalling Yosemite 10.11.1 over the existing installation

-Deleted anything related with words like "Security" and "Launchservices" from /Library/Preferences and ~/Library/Preferences

-Creating a new admin user account for testing (it behaves the same)

-Checking the startup disk from Recovery boot partition and repairing privileges from single user mode (all looks ok)

-I can also not disable Gatekeeper using "sudo spctrl --master-disable", even after having disabled System Integrity Protection (using "csrutil disable" from Recovery)

Does anyone have an idea what might be going on?

Where is Gatekeeper remembering its settings?

What else could I try before flattening the machine and starting over?