We have a client which has a PC which is infected with Game Over Zeus and their IP keeps going on a blacklist which stops their email from working. We have delisted the IP and it was fine for a week or two and then it keeps going back on but I am unable to find which PC it is.
I have tried logging traffic and also blocking known IP's, all the PC's have Sophos but don't seem to be finding anything.
Any suggestions on finding which PC it is hiding on?
Thanks!