Regarding the bad smss.exe file, you should not need to replace it with a good one although I agree it is good practice to first rename it to see if anything breaks. I believe this file is truly safe to delete. On my infected system I found the following files:

C:\Windows\smss.exe 49,152 bytes (fake file, safe to rename/delete)
C:\Windows\System32\smss.exe 45,568 bytes (real one, do not delete)
C:\Windows\ConfigSys\droenge.dll (part of the popup software)
C:\Windows\ConfigSys\dateng.dll (part of the popup software)
C:\Windows\ConfigSys\index.html (part of the popup software)
C:\Windows\ConfigSys\pop.html (part of the popup software)

The real smss.exe file used by Windows is the Windows NT Session Manager. The fake smss.exe file I suppose could be a real windows file infected with this popup software but but I suspect it in reality is simply a fake of the real thing meant to mislead people into thinking it is a real Windows system file. I checked my home system running WinXP w/SP1 (a non-infected system) and this file exists only in C:\Windows\System32 with a size of 45,568 bytes.

Also, if you open your registry on an infected system you will find the following entry which causes the smss.exe file to run upon startup, I am confident that you will not find this registry key on a non-infected system. You should delete this registry key if you find it, as always make a backup of the registry before making changes.

--------
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InteliSys
--------

The InteliSys key has a data value of C:\Windows\smss.exe (the fake as described above)

Here is a snippet of some of the text found inside the fake smss.exe file, this information may implicate the true culprit. This time I simply typed the text in so I didn't copy in any characters that would mess up the post.

---------
\Work\VB_Spyware\Spy_Forms_1.1.vb
WinDir\ConfigSys\

http://www.advertisingvision.com/xfer/pop.sw
software\Microsoft\Windows\CurrentVersion\Run
http://www.advertisingvision.com/xfer/reginstall.cgi?
http://www.advertisingvision.com/xfer/reginstall2.cgi?
---------

I hope this helps others track down those responsible and also possibly helps improve spyware removal tools. Best regards...Tony (from Minnesota)