Windows Server 2003 4.30 bug is back

I have a puzzle that I thought I had put an end to.

Windows Server 2003 shuts down at 4.30pm, not every day, not every other day, just every now and again with no recognisable pattern apart from the fact that it always happen at 4.30pm

The problem arose some months ago, two days in a row the server shut down at 4.30, then nothing for a week, then it shut down again, just once this time. Virus and Spyware scans came back all clear.

Anti-virus and anti-spyware software all reported all clear, until yesterday when AVG picked up Timer2.exe and reports it as a potential problem mentioning ServU.D which I cant seem to find any clear and concise mention of.

 

Nothing is scheduled to run at 4.30 will clean everything thoroughly and rerun scans to ensure complete healing.

Any way to find where the trojan got into the system?

 

Only Windows updates, but there are 10 users on the network and of course nobody's owning up to anything.