I am for sure that the IP address is the college. The addresses all start with 141.209.*.*, which is the colleges IP address range. Even a Whois and DNS name translation show it as the schools addresses. As for finding the infected computers, I will try to collect as much information as I can and drop everything I find off to the IT department so they can see that the infectionm is in their network.