Sortta OT: How do I see "Win32.Worm.Allaple.Gen" traffic in my Linux firewall?

[kitepilot at kitepilot.com]

Hello World:
Long story short:
I got an "official" notification that a computer behind my Linux firewall 
has the "Win32.Worm.Allaple.Gen" virus. 

I have some 150 puters NAT(ed) behind that firewall and no access whatsoever 
to any of them. 

Question is:
What can I do at the Firewall level to identify the virus' traffic so I can 
harvest the puter's IP address...
Thanks!
ET