Sounds like you most likely have a system or more then one system with a worm. Easiest way I've found to locate it is to setup a system running ethereal on a spanned port that can sniff the traffic...