Fedora Networking :: Investigate Virus Using To Port Scan Edu Sites?

I installed F14 on a friend's computer a couple of weeks ago. Today she called me saying that her ISP called her telling her they'd have to cancel her internet if she didn't fix whatever virus was sending port scans to edu domains that they'd gotten complaints from. I thought "well, there's a first"... I've got ssh to her computer, so i shelled in and ran a couple of commands, but i really know very little about how to investigate this kind of stuff.

She's directly connected to her cable modem via cat-5; but she does have a wireless card installed --she just doesn't use it, nor a router, afaik, nor as far as i'd seen when i setup her printer. I googled a bit, and ran a couple of commands, and 1 of them was interesting because it APPEARS that her wireless card is ON and the eth0 is OFF? Perhaps someone will know how to read this output better than i, and the output of the other command that i ran. Also, does anyone know any other ways to properly investigate this one? FWIW, she does use transmission to download torrents.

Anyway, here's the commands i ran:
Code:
[root@localhost ~]# ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00.

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 link/ether 00:21:97:9b:70:29 brd ff:ff:ff:ff:ff:ff

3: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000 link/ether 00:1e:e5:9c:b6:8a brd ff:ff:ff:ff:ff:ff [root@localhost ~]#