There are ActiveX-based installers for many spyware programs, and ActiveX neither looks nor acts like a downloaded application, and can be stealth-launched by cross-zone exploits without even a dialog box coming up. Microsoft seems to have shut down most (but not all) of the cross-zone exploits with SP2, but there’s still pre-SP2 systems out there, and there’s still reports of new exploits.

And even if Microsoft shuts down the cross-zone exploits, there’s still the problem that ActiveX is too easy to run. You don’t download and install ActiveX components, you just click “OK” on a routine dialog box. You can disable that by changing the setting for your security zones to block it instead of asking you, but that’s not the default. And since there are legitimate sites that use ActiveX (though fewer are requiring it these days), a significant number of people who use IE are going to be reluctant to do that and they’re expecting that dialog box to come up now and then and for it to be safe to say OK.

So ActiveX spyware installers will remain a threat even if Microsoft DOES shut down the last cross-zone exploit as long as ActiveX is treated as an “internet” technology. Until Microsoft disables the use of ActiveX except for components that are manually installed and known to be sandboxed (that is, don’t just assume all local ActiveX is safe and disable the ones that you’ve found holes in, as they do now) any browser that uses Microsoft’s HTML control (including the latest Netscape browser) is inherently unsafe and should not be used.