Your credit card information just doesn't magically get stolen. Your friend most likely added her credit card to facebook so she could buy special gifts for friends. Why do people waste money on pointless things like that I don't know.
She most likely had some other issues that she was completely unaware of.
With your USB drive, those aren't viruses. The files on the USB stick most likely became corrupted somehow. Simply format the memory stick by right clicking on the drive in "My Computer" and click format. Recopy the documents back on and you're golden.
In word documents, I have yet to come across a Macro style virus. If you're running Office 2003 or better I would not worry about such an attack.
Here is a simple trick to avoid getting infected by viruses. Do not open and download EXEs that you are unfamiliar with. That is how you get a virus 99 of the time. If you come accross an application that says you have viruses and you need to download this application to help DO NOT DOWNLOAD IT AND RUN IT. If you also can't close out the window CTRL+Alt+Delete out of the window.
Follow my instructions in the quote brackets below. I ran windows XP for almost 7 years and now Windows 7 without Antivirus software. I only use a firewall. I have never gotten a virus with this set up. For you however I would use Antivirus software just because you're not me
The best advice I can give you is to never use internet explorer. Period. My parents had some sort of odd fetish for it and would come whining to me when they had problems. I would get so annoyed with them that I decided to go corporate IT on them. This is my set up and it has served me well. Over the summer I deployed this set up over an entire school using group policy in Active Directory. I swapped the Firefox and internet explorer icons and so far the teachers and students can't even see the difference
Edit: Angel, your friend was a victim of a phising attack. Basically the link she clicked forwarded her to a website that looked like facebook but was not actually facebook. She logged into a website that looked like facebook that was completely outside of facebooks control. Once she did that the hacker had her log in credentials and was able to spam her friends. This happens quite often and it is easily fixed by changing ones password. This type of attack is also used on bank websites (BoA, Paypal, etc).