Something tells me you have a bit more than plain jane ol Welchia worm..

here is a go.. do a HJT scan in safemode and post it back here (HJT=HijackThis from http://www.merijn.org/

If Welchia is on your system IT WASNT PATCHED when it became infected.. it is probable that a few other bugs of the Agobot, gaobot families are probably present and accounted for (hmm prolly not if you managed to patch the box.. but It will be interesting to see the scan)