Hi i've made a real amateur stuff up and got a virus via a p2p network. It seems to have all the symptoms of the MS Blast worm with the NT AUTHORITY system shutdown. The text in the box is in spanish however and does not mention the remote procedure call, I have tried all the scanners of the symantec website and done a full system scan to no avail. I did find a strange file in the windows/system 32 folder: YP-239P.exe which matched some of the spanish text in the NT AUTHORITY window, said file now deleted but i believe the damage has already been done as the system continues to randomly shut itself down. Anyone any ideas on a repair... Many thanks Ginj

try starting in safe mode, check msconfig for unknown startup files and disable, try adaware- se scan, empty temp folder, also try system restore prior to date of error if available...:)

I'm french (so sorry for bad english...) And I've got the same problem... It's a blaster-like worm but there's nothing to stop it so far. I've noticed that shutdowns are NOT random but always at same minutes of every hour... Still working on a solution... If someone has any...

I've got the solution... This is not a worm. It only schedules 24 tasks in windows scheduler. Each task runs a "shutdown" command. You only have to delete the tasks to solve the problem. NB : be sure that the YV-239P.exe is deleted and is not run at startup (msconfig)as I don't know if it can re-schedule such tasks !

thanks guys problem solved!!

hey guys, please can you say me the tasks, which the worm starts?? In what category are these tasks?? Please answer! thanks