Kelihos Spambot - Ideas, Suggestions?

I noticed we're on the Spamhaus CBL for Kelihos infection.
Unfortunately, we're unable to locate the infection directly, though we have run Norton Power Eraser on every device at our location (~50 devices total.)
We have no mail server, so it can't be a false positive, and we do not use relay servers. (We run nothing from our office but end user machines...possibly outlook configuration generating a false positive?)

Anyone know of any tools or utility sites we can utilize to pinpoint the infection, outside of port monitoring?

(As a preamble, I came into the company after they expanded, and of course nobody thinks they need security until it's too late. I get to pick the pieces up, here. Just looking for suggestions or ideas from anyone interested in theorizing, hah!)

Thanks in advance.