on't think this was all a worm as they were on the box for about 30 minutes. Lots of services terminated unexpectedly and than turned back on when the guy left, They also signed in as the local admin.

I'm going to run a retina scan tonight to see teh security hole he used to get the local admin pass.