Hi Folks,
I was infected with WebBuying and other nasties, went through the (very helpful) "you must do this" steps - to wit, have done AVG, Activescan, plus Spybot S&D and Windows Defender full scan. Everything now comes up clean but for some cookies which I have come to accept as a cost of doing business. I no longer get the WebBuying popups.

However when I am on the web and surf to a new page I can see a popunder (looks like 3 IE windows that flip up and then go away). I don't get another IE window in the task bar and when I look in Task Manager I only see 1 IE window in the Applications tab (the one that I am actually reading). At the same time, under Processes tab I can see the Phantom IE window - it is there as a second iexplorer.exe process with a consistent signature (no CPU usage after the initial blip and ~21.9K mem usage). If I End Process on the Phantom iexplorer, I can keep surfing the page I was reading no problem and the Phantom doesn't re-appear until I surf to another page. Sometimes I even get a couple of free page launches before it comes back but eventually I will notice it pop back under.

I have taken to just keeping Task Mgr open and squashing these Phantoms when they pop under but am wondering what the deal is. Am I infected? Or is this just a normal quirk in IE?

Not posting a Hijack log right now since there may be a simple explanation but if someone says I need to am happy to.

Thanks in Advance!
Buster

Sorry for the Bump - I think I have figured this out myself. Did a Hijack This run and saw some lingering traces of some nasty things that hadn't been fully removed by AVG and Activescan, so removed them. Took a couple of cycles to get it all removed but I think I have it beat now. I'll repost if things start to re-appear but for now consider this Case Closed.

Thanks though for providing the service!
Buster