This. More than likely the btc stealing software. Face2Face is not always a good decision. Never allow someone to install something, or put something into your computer. I would have had him write down his address, not bring a flash drive. Your bitcoins can possibly be returned if you backed up your wallet with an encryption. He shouldn't be able to do anything with them as long as you did that. Also why do you post this in the noob section? Shouldn't this go in the support section?
Where do you get this idea? If the coins are gone they are gone. There is no getting them back (at least not through the protcol). An encrypted version of the wallet does nothing if the attacker has access to your system. They can install anything including a keylogger to record and transmit your passphrase the next time you type it and a rootkit to hide any trace it ever existed.
In otherwords, you think the guy spent hundreds of dollars for hacking software to gain a couple btc? I doubt anyone would want to go through that much trouble, or even gain federal offences on their names over something that does not truely exist.