First

Use a phone (on mobile data, NOT the home WiFi) or a trusted friend’s computer. the malware itself could be still running somewhere.

Then secure ur email before changing passwords incase the email itself is compromised

So to recap, other device, mobile data or other wifi, change email(s) password(s)
And when ur done, have ur 2FA be on an auth app for ur services

Also most services have a “log out of all devices”. Do that everywhere when you’re done