I think he's too clever for his own good. This machine should have been considered beyond salvage, remove any precious data (you did have a backup, didn't you?) and re-image. I've had to recover data from hacked boxes a few times for 'brand new customers' and the first thing I do with a system like that is to make sure I get a console wired up and the uplink disconnected. No point in taking chances.