re: those sneaky bastards
C:\Windows\SMSS.EXE really is the culprit, if you open this executable with notepad, then scroll down through the file you will find the following text. The size of SMSS.EXE on my system is 49,152 bytes. Note that \ConfigSys\droenge.dll and dateng.dll are referenced. Also, it appears to call http://www.advertisingvision.com, I speculate that if someone tracks down the owner of that site you will find the true culprit.
--Tony
