Well once sasser is installed, a patch wont fix anything. But the sasser viruses are like "23456_up" or something like that. It does look like a generated name though.

Norton [strike]picked[/strike] didn't pick up a virus.
Neither did housecall. And viewing its contents doesn't reveal any files, so maybe its encrypted? Zip passes are easiely cracked, I'm gonna check that out.

Not encrypted according to passware.

Hexplorer dissassembled code:
push eax
dec ebx
add eax, 0x6
add [eax], al
add [eax], al
add [eax], al
add [eax], al
add [eax], al
add [eax], al
add [eax], al
add [eax], al
add [eax], al

whatever the hell that means. It's only 22 bytes, is that enough to do anything more that make a memory leak or something?