I’ve been tasked with helping the security department close up a few holes. They are in the process of hiring a dedicated network guy, but for the time being, I’m the closest they have. They’ve already closed off Skype and IM, and they just heard about TeamViewer and are concerned about people getting in and accessing our PCs via that route.
Obviously we’re safe as long as nobody in the office is using it, but that rule has no teeth if it can't be detected. Where should we be looking, and what should we look for to know if someone has it installed, or (since you can use it without installing as well) is currently using or has used it in the past? Does this sort of thing show up in web request logs, since TV uses port 80?