"Companies don't want to be doing patches all the time," he said. "It's a tough job for security administrators to keep track of everything." Microsoft's next round of monthly vulnerability announcements is scheduled for Tuesday, and Cottingham urges IT managers and security officers to move quickly to install patches to ensure they're protected. He noted that users who had installed the patch for "MS 04-011"--the vulnerability exploited by the Sasser writer--were protected from all four known variants of Sasser. The worm exploited a weakness in Microsoft Windows Local Security Authority Subsystem Service. Sasser has a deadly feature--it spreads from server to server and is not activated by E-mail. "There's no user intervention," he said. "That makes it more dangerous." Microsoft is scheduled to introduce an XP feature later this year that would install security patches automatically. Cottingham warned that Sasser is likely to pop up among unsuspecting users for at least a year.