…Like a previous attack that produced a fake Firefox security alert, the malware comes up when a user-agent string is detected from a Firefox user browsing a malicious web site. This time though, it comes up with a replica of the real Microsoft Update page, which you only see if you’re using Internet Explorer.
“The same malicious web site is also known for hosting a fake Windows XP explorer scanner and Windows 7 scanner, said Chester Wiesniewski, senior security advisor at Sophos…”
Jun 09 2011
More 
Firefox malware disguises itself as a microsoft update- The Inquirer
