We looked it up but the transaction is not marked as RBF on the blockchain explorer. His wallet does not support RBF and it is not a RBF transaction. Is there a solution he can fix that afterwards?

I do not think that it is a very professionell malware since I was able to recover my previous funds from my compromised wallet also.

If the wallet doesn’t supports RBF then I will suggest he imports the same wallet Private key into another wallet like electrum. For clarification, a non-RBF transactions can never be turned into a RBF transaction but with the most nodes now set on Full RBF then there is a chance that if he double spends the transaction it will work. The Nodes which have settings on full RBF should get the old transaction replaced with the new one. I am not so sure but I think it might work out.

But if it is not a malware that sweeps transaction immediately then CPFP should work

That‘s the problem. He was not using a self controlled wallet like I do. I don‘t think he can request the key.

He can't request the key because there is no key; the exchange can't even provide it to him, the reason being that each account address is not associated with a private key. I'm talking about the address the exchange provides, and many others address that belong to other users using the same exchange might be controlled by one private key.

Since you withdrew your funds from your old wallet successfully maybe it is just your instinct that tells you your wallet is compromised.

Try CPFP like other suggestions above but I would suggest disconnect the compromised PC from the internet and make offline transactions from the device that you know is clean and signing it using your old wallet offline and broadcast it to your online device or copy the raw/hex codes and paste it to any pushtx sites from the following link below

- https://en.bitcoin.it/wiki/Transaction_broadcasting

You can also use your phone so that you can easily scan the QR code of the signed transaction from your old wallet.

But he already said that he have the seed phrases, so this only means that he is using a non-custodial wallet. I think crypto exchanges or the wallets that they are using are also non-custodial, so they also have its keys and as well as the keys for each users wallet/address. And I think it is possible to request it to them if it's really needed.

Unlocking the wallet without an internet connection is also possible and it is more safer to do offline transactions than the online ones. I think this is possible but most of the times we need an internet connection to access all of the features of a crypto wallet. I think what you did there is right. We need to migrate to a new wallet as much as possible if we think our wallet is compromised. Also we need to use a new device, if we don't have a knowledge to reformat the previous device that we have used.

He said it was previous funds that he withdraw, so there might still be new funds that are currently being compromised by the virus. Even if let say it was only his instincts, I think that was still great and it only shows that he is very aware about what is happening around and he can take immediate actions before the problem gets worse just in case there is. He is also doing the practice of the saying prevention is better than cure.