This is why the default configuration in most Web browsers is to prompt the user if an ActiveX control is being requested so the user can decide to download it or not (not always an easy decision).