Experts ponder coming Blaster attack

Finally, the Blaster code only checks the date when the worm code begins running. Machines that are not newly infected and have already been running, or that do not reboot on August 16 may not check the date and, thus, would not launch an attack, Hyppönen said.

"I think nothing is going to happen," he said.

Microsoft is keeping mum about how it plans to address the DOS attack this weekend.

For now, the Redmond, Washington, software giant is assuming that a high volume of attack traffic will be coming its way on August 16, and is taking steps to ensure that customers will continue to receive software updates, according to Stephen Toulouse, security program manager at Microsoft.

"We take this threat very seriously and are working diligently to prepare for what the worm might do," he said.

Toulouse declined to speculate on possible strategies for avoiding Blaster's wrath.

The company is posting patches at multiple locations on its Web site to make sure that customers can access necessary software updates even if windowsupdate.com is crippled by an attack, he said.

In addition to windowsupdate.microsoft.com, customers can obtain patches from download.microsoft.com, which is not targeted by Blaster, he said.

Information on Blaster was also posted at www.microsoft.com/security, Toulouse said.

F-Secure has been monitoring windowsupdate.com for two days and says that, for now, the site shows no signs of disruption, according to Hyppönen.

The only increase in traffic to the site Microsoft has noticed comes from customers rushing to get the software patch and block Blaster, Toulouse said.

While experts can debate what might happen, the world can best prevent disruptions from Blaster by cleaning and patching infected systems, Gullotto said.