The SANS Institute is warning of a Fake Microsoft Security Bulletin that leads to the installation of a malicious browser add-on.
Microsoft issues patches on a regular monthly schedule and information is always available from the Microsoft Security site at http://www.microsoft.com/security/. This provides links to the latest security bulletins and to Windows Update.
There's also a page on How to tell whether a security e-mail message is really from Microsoft.
The general rule is never to download a security update (whether from Microsoft or anybody else) directly by clicking on a link in email. Only download these updates from the company's Web site, which usually means Windows Update. For preference, have updates downloaded in the background by going to the Windows Security Center and setting Automatic Updates to ON.
