He apparently did.

I hate to say it but it does sound like the Sasser worm. The tools you've used may not be properly detecting it. Try visiting http://housecall.trendmicro.com and have an online...