If she's running XP she had to have connected at some point to activate. Did she remove the network cable after activating? Does she have a firewall? If not...she's 'on the internet'. She may not have used a web browser but she's exposed.
1. Would I be putting MY machine at risk as I try to clean hers? What are all the down sides?
2. Is there a good (free) program for this?
What I think I want to do is use a forum (cybertechhelp.com) to work this after I have done all I can. They do diagnostics using Hijack This! and several cleaning tools; but, it can be a lengthy process. Hence, it would be more convenient to do it from my home if that is safe.