1Referee, I would not say that only reason why people keep their coins in desktop/mobile wallets is because of money which needs to be invested in a hardware wallet, but also because most of them are not even aware that such security solutions exist at all.
Don't forget extra cost if there's no official HW seller/reseller in your country, you either must risks buying from unofficial seller or import it directly and pay import fees (which could get complicated/expensive).
Best thing you can do now is to format disk, your OS is completely compromised.
Don't forget to ask him not to save his old Windows.dat (old data) of the previous OS.
Folder windows.old only kept if you don't format the storage