A still-unpatched Internet Explorer vulnerability that's been used by attackers since late November to compromise Windows PCs is now being used by large numbers of malicious Web sites to plant spyware and adware, a security company claimed Thursday. San Diego-based Websense said in an alert that it's detected thousands of sites connecting to a main malicious URL that's "actively exploiting this vulnerability to execute malicious code," according to the warning. All it takes is a visit to one of the sites with Internet Explorer running on Windows 98, Windows Me, Windows 2000, or Windows XP, to compromise a computer, the warning noted. A bogus warning that the machine is infected with spyware appears and a so-called "spyware cleaning" application launches. That app then prompts the user to enter a credit card number. What's actually installed, however, is real spyware, which then connects to a URL in the .biz domain to download and run more than 10 other programs that install without the user's consent. According to Websense, the .biz domain Web site is real, but has been compromised by hackers. It's hosted in the U.S., and currently still online. There is no patch for the bug, which was originally reported to Microsoft in May. The bug was found nastier than first thought in November by U.K.-based security vendor Computer Terrorism Ltd. Microsoft has said it's working on a fix, but has not committed to a release date for the patch. The next regularly-scheduled patch day is Tuesday, Dec. 13. Microsoft, however, has issued a security advisory which outlines several steps users can take to protect themselves, including disabling IE's Active Scripting option.

Doug I think I seen this Thanks for the invite Linda

Thank you Doug. This is just another one of the many reasons that I do not use IE Bo

Doug, I KNOW I've seen it, but it was long before November. I suspected it was fishy (phish-y?), so didn't bite. Do you know of any legitimate companies using this warning? Thanks for the service you perform in informing us all of these dangers. Cheri

Hi Cheri, Legitimate is a fine line when it comes to advertising. I wrote a article not long ago about me, being a Internet Security geek for yrs and yrs. Then I became a Online Businessperson. I now have to deal with people and companies that are walking a fine line with Spyware. I'll keep you informed. Take care,