He has a Nano S? He should just import the paper seed into a fresh Electrum wallet or even BlueWallet on his mobile if he only has that one infected machine; then send all funds to the Ledger & that's it. Coins secured. That's the simplicity of hardware wallets.. Of course he could also buy a new laptop, rip out connectivity & set it up as an airgapped, dedicated Bitcoin machine, but that will probably need more money and time.

After that, backup files & pictures that are important, however stay careful, as you said, since they could all be infected. So maybe scan them or shit like that before putting them back onto a 'clean' machine.