check for conficker polling, 2k servers are DOS attacked to BSOD (IRQ less than or equal to) to load the conficker worm at next boot. (They still crash even if protected) (Most people now have their servers patched i.e SP4 + SMB patch), Check the security logs for failed authentications as will show the polling device/pc or server. Make sure your Av is upto date and scanning. Check scheduled tasks for spurious AT events.
then again....I probably wrong
