Good to hear about your status. If you can narrow down the problem is from one switch, you can easily sort out the bad apple could be apples. I still don't understand how your Antivirus server did not detect the bad one. You may have to make visit on every computer on that switch to make sure Symantec has been up to date. As you know I am in the industry for a while, I have seen that situation before (I am serious!). This network plan had been created years ago before the virus or worms invented. Anyway, I understand that you are in a transition and there is no clear network diagram in place. It is hard but you have to start getting one. You can see it's never too late. You can get a network probe tool to trace your cables
http://www.allspectrum.com/store/product_info.php?products_id=1116http://store.cablesplususa.com/kp100.htmlK
K