I did a small application that is intercepting all CoCreateInstance, CoCreateInstanceEx, CreateProcess, WinExec calls. They are used each time Internet Explorer opens a document. On my system (it has a lot of spywares) I detected that some popups are opened by explorer.exe .
No "strange" process was running.
How spywares "convinced" explorer.exe to open popups ? Any Ideea ?