Internet Explorer is unsafe -- still

A malignant security flaw found in all versions of Microsoft's Internet Explorer browser has yet to be fixed, and the problem is spreading. Microsoft detailed the flaw in a security update blog post six days ago. Since then, the problem has spread across the globe, hitting at least 2 million computers.

Unlike other computer exploits, this one does not require users to click on fishy links or download mysterious software: It plagues computers that simply open an infected Web page.

[ Related: "IE5, IE6 also affected by browser vulnerability" | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

Internet Explorer is currently used by 69 percent of Web surfers. The flaw hides inside the data-binding function of the browser and causes IE to quit unexpectedly and reopen vulnerable to prying eyes.

So far most of the attacks have been geographically centered on China and have been used for the purposes of stealing computer game passwords. But with a flaw as gap-toothed as this, the possibilities of nefarious action could include the massive theft of personal information such as administrative computer passwords and financial data.

Even though there is currently no patch for this problem, Microsoft has offered a variety of work-arounds. Most involve disabling or crippling the oledb32.dll file. Other methods include setting Internet and local intranet security zones to "high" and configuring Internet Explorer to prompt before running Active Scripting or to disabling Active Scripting.

Though it's always wise to keep your anti-virus software updated, it may not protect you in this case, as most anti-virus software does not monitor Internet traffic. The easiest way to keep your computer safe is to stop using Internet Explorer. Even Microsoft offered that advice. And while other browsers aren't entirely devoid of bugs, they are a better alternative in this case.

PC World is an InfoWorld affiliate.