I'm helping a friend with their Lenovo laptop running WinXP, SP3. We had done some updates, ran Microsoft Security Essentials, and cleaned off something called arcaadewebfirefox.dll that I thought wasn't too terrible. later that evening they rebooted and all desktop icons were gone, firefox was back to default profile, etc. at the same they they received a couple calls from those scammers posing as microsoft and offering to fix the computer. I didn't think it was related but they are convinced the computer was hacked.
I've determined all the current problems are due to the fact that they are logging into a different user profile called USERNAME.COMPUTERNAME, where before everything was just under USERNAME.
For example, the desktop icons being used are at:
C:\Documents and Settings\USERNAME.COMPUTERNAME\Desktop
C:\Documents and Settings\USERNAME\Desktop
where I see all their previous icons where they should be, but not being accessed.
Similarly, the Firefox profile being used is here:
C:\Documents and Settings\USERNAME.COMPUTERNAME\Application Data\Mozilla\Firefox\Profiles\qkqvn5s1.default
C:\Documents and Settings\USERNAME\Application Data\Mozilla\Firefox\Profiles\sjdi38dj.default
How could this have happened, and what is recommended to get things back the way they were? Thanks!