How do I tell if employees are using TeamViewer at work?

Question

I've been tasked with helping the security department close up a few holes. They are in the process of hiring a dedicated network guy, but for the time being, I'm the closest they have. They've already closed off Skype and IM, and they just heard about TeamViewer and are concerned about people getting in and accessing our PCs via that route. Obviously we're safe as long as nobody in the office is using it, but that rule has no teeth if it can't be detected. Where should we be looking, and what should we look for to know if someone has it installed, or (since you can use it without installing as well) is currently using or has used it in the past? Does this sort of thing show up in web request logs, since TV uses port 80?

Answer 1

The Teamviewer website [1] states that TCP port 5938 might be used, and that port seems to be open on my local machine when Teamviewer is running.

Trying running a port scan looking for machines that are open on port 5938.

I've also noticed that the built-in web server in Teamviewer replies "This site is running TeamViewer.", so do a port scan on port 80 aswell and check the results. Nmap is a nice tool for port scanning.

[1] http://www.teamviewer.com/en/kb/10-Which-ports-does-TeamViewer-use.aspx