Plesk v10.4.4 spam-sending infection

[AndriusB]

Hello,
Our plesk server is constantly being added to CBL list with a message:

This IP is infected (or NATting for a computer that is infected) with a spam-sending infection. In other words, it's participating in a botnet. If you simply remove the listing without ensuring that the infection is removed (or the NAT secured), it will probably relist again.

I tried scanning server with clamav antivirus, but it didn't find anything. Mail logs don't show anything and mailq is small (normally when user account is hacked and they start spamming queue fills up).
Maybe someone had a similar problem?