Our ancient NT4 web server which has been humming away since 1999 has been
rebooting randomly.

NT4 with sp6a, IIS, patched with all Microsoft patches as of 5/17. McAfee
4.5 indicates 5/18.

A GIS administrator handles the GIS/Land Records software and upgraded some
files from Access 97 to Access 2000, around the time it started,  I think.
Moad and/or ERSI software does the Land Records inquiry, and sits on top of
IIS.

Symptoms - Server running a little bit slower than normal (Was always slow
but somewhat slower now)

Server reboots and nothing concrete in the Event View logs.  There is over
800 *.mem files on the partition where IIS sits, and is in the root of that
partition.

I ran performance analyzer but am not finding anything. Tonight McAfee shows
a virus 'Generated Zombie' program in the inet pub folder.

Any ideas what is causing this and where to look?

Thanks

George
MCP,CNA, A+