I just finished removing the final bit of a virus on one of our servers and I'm now getting a error on reboot that at least one service failed to start. I checked the event viewer and I found the message attached to this question. Looks like it's related to the Explorer service (which I was unaware ran as a service). The solve to my last question involved removing a fake copy of explorer from C:\WINNT\System32. I'm wondering if this service was also part of the virus as well, since the service installed on the system points to that exact file. Does this sound correct? If so, how do I go about removing this service?