SUCCESS 🙂
The offender was on an XP box. The situation was Windows 2008 / SQL 2008 had a linked server to an XP box / MDSE 2000.
The DTC transactions were being run on the Win2k8/SQL2k8. The WinXP/MSDE2k was where the custom entry was located as described below. Hope that clarifies.
It was a custom entry in the host file
C:\Windows\System32\drivers\etc\hosts\
That was pointing to a retired server
What a hair puller