[Felix The Assassin]

Me tinks we are talking two different directions here. So I will take liberty of a more recent attack notification so we may understand each other better.

<<>>
W32.Novarg.A@mm is a mass-mailing worm that arrives as an attachment with the file extension .bat, .cmd, .exe, .pif, .scr, or .zip.

When a computer is infected, the worm sets up a backdoor into the system by opening TCP ports 3127 through 3198, which can potentially allow an attacker to connect to the computer and use it as a proxy to gain access to its network resources.

In addition, the backdoor can download and execute arbitrary files.

There is a 25% chance that a computer infected by the worm will perform a Denial of Service (DoS) on February 1, 2004 starting at 16:09:18 UTC, which is also the same as 08:09:18 PST, based on the machine's local system date/time. If the worm does start the DoS attack, it will not mass mail itself. It also has a trigger date to stop spreading/DoS-attacking on February 12, 2004. While the worm will stop on February 12, 2004, the backdoor component will continue to function after this date.
<<>>

Now let me re-cap. If the IT is on to something, you are clueless. He should be trying to protect you and the company from any legal wrongdoing, and protecting assests.

Now you state he did this prior to you receiveing the unit, who was the previous user? How volatile is the market you are in? What type of secrets could be lost? Better yet, what kind of deceitful, technically incorrect, secrets could bring devestation to a competitor?

To you this is a why me, end of the world event. To me, this is a challenge of the career as an IT.