10 XP machines shutdown at same time in lab

[Guest]

Have 10 XP machines (all were upgraded from Win98). About every week or so
get message "lsass... shutdown..restart in 60 seconds". I know it sounds like
sasser, etc. I've checked for all the virus' and they are clean. Have Norton
Corporate Edition Anti-virus. Definitions are up-to-date. Also downloaded
and ran the fixes for Sasser, MyDoom, etc ( didn't find any of the virus').
There are about 300 systems in this network, these 10 are in a lab with
10.X.X.X ip addresses in sequence. And what is really confusing me is that
all 10 do it at the same time, within seconds of each other. Any ideas?

 

[Kevin]

I would still suspect something like the Sasser or Blaster worm even though
you are using Norton CE Anti-Virus. Have you disabled System Restore on
these 10 suspect machines to eliminate a possible hiding place for worms or
viruses? Of course, you will lose all information for the restore points
when you do that, but some malware can (and does) hide a copy of itself in
System Restore.

Can you isolate these 10 machines from the rest of the network? Can you
isolate one of the ten from the other nine and the remainder of the network.
If so, this may help you ascertain what is happening and where it is
happening.