The flyers were fake parking violation notices, and instructed people to
visit a website to pay. Once they visited the website, they were infected
with a malicious browser helper object.
The initial program installed itself as a browser helper object (BHO) for
Internet Exploter that downloaded a component from childhe.com and attempted
to trick the victim into installing a fake anti-virus scanner from
bestantispyware securityscan.com and protectionsoft warecheck.com.

I read through your post (and a couple of older ones two) and your blogs been a great find – ive noted your rss so expect me back in the near future – thanks