There are couple of more files to look at. For example, "/etc/sudoers, /etc/automount.sh, /etc/group, /usr/share/knoppix-terminalserver/template/miniroot/*, the knoppix installer scripts i.e. knx-hdinstall and knoppix-installer". In fact you will have to go through each and every shell script carefully to remove any traces of user "knoppix".

Update with the progress....