Port Hijacking

Wireshark (aka Ethereal) would be a good place to start. Install it on the test machine or on a second machine that shares the connection used by the target (use a mini-hub or a tap). Using the latter you'll be able to see what happens while the target machine is starting up too

I've seen such symptoms once propagate through a 35 machines lab. It was a virus. Not only it opened many IE windows, it also downloads OTHER VIRUSES.

Ya, Once you connect the PC to the main switch it gets infected. By simply switching ON the winXP firewall, it couldn't affect the machines. Updating for patches resolves the issue. But an infected machine needed a virus scan, And there was loads and loads of them.