most worms have an 'installed' marker somewhere on the system. the loader will check the mark and if not present, will install and reboot. my sense is that the marker wasn't being set properly resulting in this bug.

I had the same bug in a worm I wrote. I was storing the marker in the local user part of the registry, which was being loaded from the domain controller, so the bit wasn't being retained.