Ezula and Web Offer Download as soon as connection is detected

Greetings all. Hope someone can help me out on this one. The system is a Compaq Laptop running W98SE that we keep in the kitchen that is used mainly for email and the kids to do Internet research on for school. No other systems in the house are infected like this. We are using a Dial-Up connection. The problem is that whenever the system gets connected to the Internet, within a minute or so, both Ezula and its' partner Adware Web Offer begin to get downloaded and installed. It is detected by Spy Sweeper and removed during a sweep. It is also detected By Spy Sweeper as an alert for Start-up files. According to installation the log of both Ezula and Web Offer, it actually creates the directory for installation. (It is deleted during Spy Sweepers' sweep). I have done eveything I can to try to find what it is that is making the system download and begin installation. The only way I have found to stop it so far is to turn off download ability in Internet Options. I really don't want to do this for obvious reasons. I also tried dis-abling various Script and Active-X functions. The problem there is that most legitimate Websites that we visit also use them and it is very tedious to have to click "allow" again and again and again. How can I figure out just what file is being used to detect the network and download the file from wherever it is coming from? Please help.