'cd ". "' is valid; it means "set the current directory to the one named [dot][space]".
I assumed it was something he'd seen as a way to sortof-conceal a directory, since it's both hidden and looks a lot like the [dot] directory that you'd expect to find everywhere.
Actually, you guys are both right. Speaking from experience (administrator at a popular webhosting company), he likely a lot of his rootkits macroed, so he can just login to the box, alt+1 (or whatever he has his macro set to) and then pop out. When the macros fail, he demonstrates his lack of actual knowledge of *nix systems and starts acting erratically.
A script sophisticated enough to replicate the behaviour of a real user at a shell like this would likely actually achieve something.
Anyone clever enough to write a script that does this, wouldn't, because they'd also be clever enough to realise that it's utterly pointless.
The win2k service pack was likely filling the role of "a big file from a fast CDN," for the purposes of testing the machine's connection.