As stated above, disconnect the computer from the Internet access for the time being. I would do a few diagnostic things to see what is up:

Go to accessories, system tools, and tell it to get rid of temporary files. Defrag the computer and get stuff tidied in there. How does the space look now? Though it may seem counterintuitive, without logging on still, have him uninstall his copies of Norton Antivirus, Firewall, etc., then reinstall them fresh. Only when this has happened should he then go back online and immediately download the newest definitions. Disconnect again and let the Norton software do it's fullest scan available to search for the problems. From there I would go back online and do the one-two punch of AdAware and Spybot Search&Destroy to see what malware is in there.

Spybot may offer to backup the registry, but if it has been fried by malware, your friend may not want a backup of it.

Finally, you said he's using "XE" but do you actually mean XP? There is a "go back" feature (I haven't used it, I use Win2000Pro which doesn't have it, and on my kids' computer with XP Pro I haven't had to use it). When did these troubles begin? Choose a date before that and set the machine to restore itself.

Hope this helps. It's the short version, anyway, until John in Kansas notices this thread! :)

SRS