Remote Anything Trojan

I would like to know if any of you members out there had experienced dealing with employees using Remote Anything without the permission of the Network Administrator. Just recently, our mail server had been ‘hacked’. After checking the suspected workstation, I found a stealth application that was installed, that is, Remote Anything slave.exe. We then audited all the ompany workstations and found several other, including our mail server. How can I find the workstation containing the master.exe? Please help me.