LSASS.exe Shutdown

I manage +/- 80 w2k client pc’s in a closed lan attached to a Netware 6 server. SAV 8 is running on the server and on the local w/s. Today it was reported that 4 pc were being forced to shutdown after a 60 sec countdown (looked like the sasser and blaster worm). SAV and Stinger reported nothing, Symantec FixBlast & FixSasser removal tools cannot find anything. The registry keys hklm/…./currentversion/run shows nothing suspicious. Any hints / sugestions will be greatly appreciated. Thanks..