Benjamin Edelman took a standard, unpatched install of XP and pointed it at one single website known to contain spyware. He wrote up and even produced a 8 minute video of the results. In his testing, at least the following programs were installed through the security hole exploit: 180solutions, BlazeFind, BookedSpace, CashBack by BargainBuddy, ClickSpring, CoolWebSearch, DyFuca, Hoost, IBIS Toolbar, ISTbar, Power Scan, SideFind, TIB Browser, WebRebates (a TopMoxie distributor), WinAD, and WindUpdates. That's the same WindUpdates that are faking system dialogs in order to get users running SP2 to install their spyware. This would be amusing if it wasn't such a risk for the majority of windows users.