How do you know she got netbus? And how do you know the guy is using xp?
Anyway, hacking back is stupid.. Just find his IP and the time he was logged on the Net and report him to his ISP. If you do that correctly he could lose his connection.