When this was happening to me a trace did show the connection string that was failing containing the name a database that had been previously dropped, but there was still a client out there tying to connect. It was then a simple matter to to look at the machine owning the IP and disable the client software.