I don't remember details, it happened already some time ago.<p>It was actually quite sophisticated malware - heavily obfuscated, assembling itself from pieces spread all around the world, jumping through several hoops of compromised servers.<p>When I finally managed to reverse engineer to JS code that carried the infection, it was full of functions I didn't even know existed. Not usual JS, more like API hooks to the underlying platform, with special prefixed names. These names indicated it was about plugins.<p>BTW it was multiplatform, attacking not just Firefox, there was a browser detection and browser specific code paths for several popular browser. I remember there was also something trying to use Silverlight.<p>Oh, and it was multipurpose. Besides trying to infect your PC with a malware, it was also earning money. Some parts of JS were loading ads in invisible frames, presumably to be part of some distributed click farm.