Microsoft's free Internet-based email service, Hotmail, has been spreading viruses for the past six months, a top UK Internet service provider (ISP) has claimed.

Microsoft, which has been concentrating on Hotmail security holes, has not fixed the problem, says the British Internet service provider, Star Internet.

A security hole - that let anyone read Hotmail users' mail without knowing passwords - was revealed in late August. Microsoft quickly solved that problem. On October 4, Microsoft announced all Hotmail flaws had been found and corrected, and that "we have implemented several quality-control procedures, to help prevent future incidents of this kind".

Customer fury This self-confident attitude angered many - and Star Internet has since discovered 122 viruses from Hotmail accounts. Some of these were macro viruses, which have been known to affect Macs.

According to Alex Shipp, virus technologist at Star Internet, Hotmail is now the number worst offender on viruses sent to Star Internet. He added that Star Internet has told Microsoft technical support officials about the many viruses back in May. However, Hotmail's 300,000 users in Denmark - and 50 million users worldwide - are still receiving and sending email containing viruses, such as Melissa.

"Microsoft has told us several times that they can stop viruses like Melissa. Each time we have proven them wrong. Later they confirmed our statement," Shipp said.

One possible explanation is that Microsoft's Hotmail is not running under Windows NT. Microsoft bought the product from another company, and it is running on the free Unix variant FreeBSD. There is a McAfee anti-virus installed on Hotmail, but the product is so old that it cannot locate a macro virus.

There is a newer, Unix-based version, of the McAfee programme that can handle macros, but it only runs on Sun Microsystems's Solaris. This solution would not be appealing to Microsoft, as Sun is Microsoft's chief rival. Microsoft could have bought another anti-virus product from the company Sophos, but has chosen not to, according to Shipp.

Microsoft declined to comment.