Your system is definitely compromised. Best thing might actually be to do a clean install and get a new set of private keys.
Whatever you do, do not touch your keys ever again, the hacker will always have access to them.
It indicates that he will never get his bitcoins back again?
He can't complain regarding the issue to somebody?
The chances of him getting those back are slim to none.
There is always the possibility that it was someone close to him that had physical access to his pc at some point.