While it is possible, it seems highly unlikely that a system with limited connectivity and little user-population such as a DSLR gets targeted by malware. There is no similarity between manufacturers, let alone between most camera models from the same manufacturer. E.g. try to run a Magic Lantern (a third party "firmware" for some Canon cameras) version for a Canon EOS 5D III on a Canon EOS 5D II or Canon EOS M6. Or a Nikon D4.

The effort to target a DSLR with malware seems to be in no relation to what can be gained by it.

Since it seems that your system is compromised, it would be best to thoroughly "clean" it. See for example superuser's "How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?". I still think that either your computer's hard drive was not properly formatted or that your girlfriend's PC infested the new SD card with the malware (Not every malware can be detected by any A/V software). Some malware is really nasty to get rid of, so it might be necessary to think about every step you take from here twice until you are absolutely positive that your system is safe again. For example, do not connect any external media to a system that might be compromised by malware.