New zero-day security vulnerability found in Internet Explorer

Security experts have urged people to stop using Internet Explorer following the discovery of a major security flaw.

The flaw found, known as a zero-day vulnerability, is hard to spot and requires a lot of technical knowledge to exploit. Only eight such flaws were found in 2011.

Read more: Security news | Antivirus reviews

People running Internet Explorer 6, 7, 8 and 9 are all affected on Windows 7, Vista and XP. Microsoft said it is developing a security update, but this may take some time.

A temporary fix has been released, with users asked to download the Enhanced Mitigation Experience Toolkit. But security experts say this may be too complex for most users and that the best action is to change browsers – alternatives include Mozilla's Firefox and Google Chrome.

The zero-day vulnerability in Internet Explorer was discovered by Eric Romang, an IT security advisor based in Luxembourg.

Mr Romang said he found the new vulnerability when his PC was infected with malicious software known as Poison Ivy. While investigating the attack, he found that the malicious software had been installed using a previously unknown zero-day vulnerability.

The exploit comes in four parts. The first is a file called exploit.html. This is followed by an Adobe Flash file called Moh2010.swf. This code is used to execute a second HTML file called protect.html, which triggers the vulnerability. Finally an executable file called 111.exe runs the malicious software.