I hope he recovers it. it becoming a real pain tbh and the anti virus barely detect it until they try to breach GOOGLE PASSWORDS. Someone hacked into my siblings accounts in a similar manner. Honestly eveb 3rd party apps verified by antivirus which was in our case too.
Moral of the story, Don't run anything 3rd party shit as administrator unless its a platform known for their product's safety.