It's actually IE that brings this up. Potentially the file may have downloaded if you chose Save As.. and picked a place to save it rather than just Save when prompted.

I'm not sure what Microsoft Security Essentials mean by the error message. But definitely, there's no way it can verify "the publisher" as we are not registered anywhere.

Edit 2021: Since 4.3.6, WinSCP binaries are signed with publisher certificate.
https://winscp.net/tracker/505

The publisher of winscp434setup.exe couldn't be verified.

During download.

Windows 7
IE 9

Microsoft Security Essentials
Definitions created on: 8/22/2011 at 3:45 AM
Virus definition version: 1.111.433.0
Spyware definition version: 1.111.433.0