Could be a lot of things, and to really know the answer you'd need to know specifically what bit of malware she's been inflicted with. Some are part of a botnet, that will generally only operate when they're given some kind of command, others have a predefined set of operations to carry out... So there's really no answer to the question without knowing what specific bit of malware she's been hit with. Just some general possibilities like I outlined.