Admin this removal of the ctb malware and restore with shadow explorer tutorial should work for you to find your cold wallet files again, good luck.
https://www.youtube.com/watch?v=GtjYb1I9M5o
https://www.youtube.com/watch?v=GtjYb1I9M5o
That video is pretty old. Not sure if they updated the virus, who knows?
Anyway, admin, could you take a few more screenshots to prove that this virus is real? I did some reason, so taking just a few more screenshots like for example one with them stating the deposit address would make your case much more belivable.
Hopefully you're telling the truth, but in this section you can never really trust anyone.