For the record, by the time I dled Spybot yesterday, I didn't really have crap left on my machine (unless you count tracking cookies, which don't bother me that much since they're easily deleted). AdAware had caught a few bits of Xupiter/OrbitExplorer that I hadn't deleted, as well as another bit of spyware that I'd been infected with at the same time (and that I had first assumed was part of the other crap since it was all dumped on me at once).

Aside from that, I had an Alexa registry entry (not surprising, since that's part of the "show related links" in IE6) and evidence of browser highjacking attempts (most likely from the X/OE). So really all I'm left wondering is what left me so vulnerable yesterday.