Getting smashed by Spambot

Hi All,

For the past two days we have been smashed by some malware internally and keep getting failure to deliver msgs back from axchange where the receiver is checking us against CBL lists and SpamHaus.

e.g. #550 5.7.1 xxx.xxx.xxx.xxx has been blocked by Spam Haus ##

When I goto the cbl list and look at the msg I am being advised of the following:

It has been relisted following a previous removal at 2009-07-28 00:24 GMT

ATTENTION: At the time of detection, this IP was infected with, or NATting for a computer infected with a high volume spam sending trojan - it is participating or facilitating a botnet sending spam or spreading virus/spam trojans.

ATTENTION: If you simply repeatedly remove this IP address from the CBL without correcting the problem, the CBL WILL eventually stop letting you delist it and you will have to contact us directly.

This is the gheg spamBOT


I am waiting on access to the firewall to block outbound port 25 except where from the mail server but short of this it is driving me mental. Any thoughts on a good tool I can run en-mass to detect and remove this or look for alternative cause. I have researched and researched the web but the most I am getting is to try MS's Malicious Software Remote Tool and this keeps drawing a blank.

I delisted today and got re-listed 8 hours later. The company as a host of servers and a nubmer of PC's and laptops

Signed
Mildly Frustrated