mackeeper has been updated (?) several times since it hit the scene, so it's difficult to say with any certainty which variation your friend has.
My general procedure for malware removal is to reboot into safe mode, and browse:
/Library/StartupItems/
/Library/LaunchAgents/
/Library/LaunchDaemons/
~/Library/LaunchAgents/
/Applications/
and also check system prefs, accounts, my account, login items
and remove everything that does not belong. I also look at what I am removing, to see what IT is trying to hook, and I go and throw that away too. Then restart.
MacKeeper is often known under "zeobit". You are very likely to encounter that prefix in the launch daemons and agents. ("com.zeobit.MacKeeper.plugin...") While there will be at least a FEW things that are not "com.apple....", those are the ones you should pay close attention to. Check another known ok mac when in doubt. Oracle, Microsoft, and Adobe are the top three normally found that belong there.
