Hi ellen bezpa
Welcome to TSG!
I'm pasting the log in the thread. It is easier to analyze that way.
Logfile of HijackThis v1.97.7
Scan saved at 9:10:17 PM, on 4/5/04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\OPTIMUM ONLINE\NETSURF.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\SCANJET\PRECISIONSCANPRO\HPLAMP.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUNOTIFY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\XQ0P0F7F.EXE
C:\PROGRAM FILES\HP DESKJET 895C SERIES\EREG\REMIND32.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\WINDOWS\SYSTEM\HPFBKG15.EXE
C:\WINDOWS\HPFTBX15.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.optonline.net/Home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.optonline.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
F1 - win.ini: run=hpfsched
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
O2 - BHO: (no name) - {B549456D-F5D0-4641-BCED-8648A0C13D83} - C:\WINDOWS\BrowserHelper.dll
O2 - BHO: (no name) - {000006b1-19b5-414a-849f-2a3c64ae6939} - (no file)
O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8} - C:\PROGRAM FILES\LYCOS\SIDESEARCH\SIDESEARCH13218.DLL
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file)
O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [HP Lamp] C:\SCANJET\PrecisionScanPro\HPLamp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [ClrSchLoader] \Progra~1\Lycos\IEagent\Loader.exe
O4 - HKLM\..\Run: [SAHAGENT] C:\WINDOWS\SYSTEM\SahAgent.exe
O4 - HKLM\..\Run: [XQ0P0F7F.EXE] C:\WINDOWS\XQ0P0F7F.EXE /dk
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKCU\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
O4 - HKCU\..\Run: [XQ0P0F7F.EXE] C:\WINDOWS\XQ0P0F7F.EXE /dk
O4 - Startup: 4RDCI3E9.lnk = C:\WINDOWS\4rdci3e9.exe
O4 - Startup: XQ0P0F7F.lnk = C:\WINDOWS\xq0p0f7f.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Reminder-hpc41001.lnk = C:\Program Files\HP DeskJet 895C Series\ereg\Remind32.exe
O4 - Startup: PPF5RVB1.lnk = C:\WINDOWS\ppf5rvb1.exe
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
O4 - Global Startup: KEHTGLZG.lnk = C:\WINDOWS\MORZE5.EXE
O4 - Global Startup: R60HK2K6.lnk = C:\WINDOWS\MORZE5.EXE
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\9rv8flbk.exe
O4 - Global Startup: NO3CFP41.lnk = C:\WINDOWS\MORZE5.EXE
O4 - Global Startup: 0DRM7CG0.lnk = C:\WINDOWS\9rv8flbk.exe
O4 - Global Startup: XKHB8A47.lnk = C:\WINDOWS\MORZE5.EXE
O4 - Global Startup: 3QJ7RD0E.lnk = C:\WINDOWS\3qj7rd0e.exe
O4 - Global Startup: 6MB1JZ2F.lnk = C:\WINDOWS\6mb1jz2f.exe
O4 - Global Startup: 8X4KWNNL.lnk = C:\WINDOWS\MORZE5.EXE
O4 - Global Startup: MEXFMKI9.lnk = C:\WINDOWS\MORZE5.EXE
O4 - Global Startup: BP0B9CVU.lnk = C:\WINDOWS\MORZE5.EXE
O4 - Global Startup: 0GQHPJJC.lnk = C:\WINDOWS\MORZE5.EXE
O4 - Global Startup: BD6424KQ.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: BZ52WULO.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: WIWJJHT8.lnk = C:\WINDOWS\wiwjjht8.exe
O4 - Global Startup: 0RBF4QZ4.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: UC34JWKM.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: L7XMOH9B.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: U40OX1AV.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: PG1RDCBQ.lnk = C:\WINDOWS\pg1rdcbq.exe
O4 - Global Startup: LZEXR6AB.lnk = C:\WINDOWS\9rv8flbk.exe
O4 - Global Startup: 9RV8FLBK.lnk = C:\WINDOWS\9rv8flbk.exe
O4 - Global Startup: NNNP3XAG.lnk = C:\WINDOWS\nnnp3xag.exe
O4 - Global Startup: 8PYU0A40.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: 9OP37ZPO.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: JA0D5X3A.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: OJH8TO2H.lnk = C:\WINDOWS\ojh8to2h.exe
O4 - Global Startup: VC23J8XN.lnk = C:\WINDOWS\vc23j8xn.exe
O4 - Global Startup: WJ2IG3ER.lnk = C:\WINDOWS\wj2ig3er.exe
O4 - Global Startup: 533T99P7.lnk = C:\WINDOWS\533t99p7.exe
O4 - Global Startup: EZPYC9RH.lnk = C:\WINDOWS\ezpyc9rh.exe
O4 - Global Startup: MT6XPAYZ.lnk = C:\WINDOWS\mt6xpayz.exe
O4 - Global Startup: HNXKMC0K.lnk = C:\WINDOWS\hnxkmc0k.exe
O4 - Global Startup: 9V471JB0.lnk = C:\WINDOWS\9v471jb0.exe
O4 - Global Startup: 4RDCI3E9.lnk = C:\WINDOWS\4rdci3e9.exe
O4 - Global Startup: XQ0P0F7F.lnk = C:\WINDOWS\xq0p0f7f.exe
O4 - Global Startup: PPF5RVB1.lnk = C:\WINDOWS\ppf5rvb1.exe
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Sidesearch (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: Yahoo! Bingo -
http://download.yahoo.com/games/clients/y/xr2_x.cab
O16 - DPF: Yahoo! Checkers -
http://download.yahoo.com/games/clients/y/kr2_x.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) -
http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -
https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: symsupportutil -
https://www-secure.symantec.com/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) -
http://download.toontown.com/sv1.0.8.6/ttinst.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
http://207.188.7.150/2418ea529dbfdab92521/netzip/RdxIE601.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37986.3537037037
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) -
http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab