Experts: Microsoft tweaks, new laws won't make '04 safer

However, the seeds of change Microsoft plants in XP SP2 might take years to bear fruit, he said. "We're still seeing viruses that use (Microsoft) Outlook address book vulnerabilities, and the cumulative patch for that came out two years ago," Hughes said.

Finally, the 2004 Presidential election will continue to focus public and media attention on the security of embedded operating systems in everything from electronic voting kiosks to automated teller machines (ATMs) and SCADA (supervisory control and data acquisition) systems that run critical infrastructure, experts said.

Security flaws, the increasing use of embedded versions of Windows and the near-total dominance of the TCP/IP networking protocol make it likely that virus and worm outbreaks will affect private networks used by ATMs, utilities and other critical systems, even if those systems do not run Windows, F-Secure's Hyppönen said.

"In the old days, these systems used proprietary protocols that were immune to Internet worms. Now you have embedded systems connected via TCP/IP to corporate intranets and office systems. Internet worms like Blaster and Slammer, because they try every possible (Internet) address, will find these systems, which hackers would never find, and end up in places nobody imagined," he said.

Such outbreaks have started to raise questions about the wisdom of creating homogenous populations of computers running Microsoft software, Stiennon said. "One thing that changed dramatically in 2003 was the world's acceptance of the philosophy of 'Microsoft everywhere'," he said.