W32.Downadup

Various machines infected with W32.Downadup (seems to have spread over network). SAV10 is deleting instances of the files it finds, but they keep reappearing, so the root cause is still around. Run Malwarebytes Anti-Malware as suggested on another thread & it has found machine to be clean. Followed Symantec's removal instructions & Used a F-Secure removal tool that didn't find any instances.

Firewalls indicating the malware isn't trying to make any outbound connections, so am OK in that sense at the moment, but would like to find & remove root cause. Any ideas?

I've used SAV10, Windows Defender, Malwarebytes, Ad-Aware......