I'd bet that it was installed after downloading. Get MyUninstaller and check out the list of installed programs. If it did get installed thru firefox I would suspect that it used javascript and would recommand installing NoScript. As for a virus scanner NOD32 is the best virus scanner I have ever used. It doesn't really get in the way unlike everything else I've tried. As an example start Azureus after booting up Windows. When running Mcafee Azureus can take 3 to 5 minutes to start and with NOD32 it takes less than 10 seconds.