It would be interesting to try and build a signature of the malware invisible windows. When loading an IE browser are there any signs that the page is not visible... would something like https://github.com/Valve/fingerprintjs uniquely detect the hidden IE windows?

[EDIT] another thing that could be helpful in building a signature is: http://stackoverflow.com/questions/1060008/is-there-a-way-to...