Malwarebytes freebie, run from Safe Mode if possible, as a starter for 10...
Tried that Jaime, and nothing untoward detected. 
Mind you, I would still like the answer as to what files should be hidden/read-only.
Hidden will make jack all difference to operation... ...its there to stop stupid people deleting shit they don't understand.
Didn't think XP was secure enough to have much in the way of Read Only files TBH. Would need to find an XP machine to check against if you are still having problems.
Windows Update... ...bit of Billy Boolax being spoken here. Yes, its a good thing to have, and really should be on. HOWEVER, it would not have stopped this incident.
The biggest single thing you can do to prevent a repeat, is not run as a computer Administrator (I'll bet a gonad that you are). Yes, I know thats like slagging off your penile size, but honestly, try to run as a limited user. Then, anything you run, mostly only gets limited rights to your system, making it harder for it to infect it. Running as an admin gives all these website scripts (that you cannot necessarily control

) admin rights you your system.
Same with disabling UAC on Vista or Win7 - you'd have to be pretty retarded to do so, or to quote and old boss of mine, "a bigger *cough* than you think you are".