ZeroAccess botnet detection

Greetings,

I have a firewall reporting a large amount of traffic destined for port 16464 being blocked from source IPs in countries all over the world. After doing some research online, I found the following info about the ZeroAccess botnet, 16464 is one of its used ports:
http://secureconnexion.wordpress.com/tag/port-16464/
http://www.sophos.com/en-us/medialibrary/PDFs/technical papers/Sophos_ZeroAccess_Botnet.pdf

I have about 50 workstations that I would like to check for this infection as a safety precaution, any idea how I can reliably check if these workstations are infected with ZeroAccess?

Thanks!