(CBS/AP) A second "blaster" worm Internet attack Saturday caused no major problems. A Microsoft spokesman said there was no impact on the company's Web site or any other Web sites.

Still, Microsoft urged customers to take precautions to fend off an infection. That means using a firewall, keeping Windows software updated and making sure your computer has the latest antivirus software.

The virus-like infection exploits a flaw in most current versions of Microsoft's Windows operating system for personal computers, laptops and server computers. Although Microsoft posted a software fix last month, many users failed to download it.

The security firm Symantec Corporation said the worm infected more than 350,000 computers around the world since last Monday, causing them to reboot frequently or disrupting Internet browsing. It snarled corporate networks with an inundation of data packets and frustrated home computer users unversed in techie triage.

Computer technicians had a busy week either cleaning up after the "LovSan" or "blaster" worm that invaded tens of thousands of computers or upgrading software security.

One security expert warns of 70 new computer threats every week, making it a full-time job to keep virus guards and firewalls up to date.

The virus-like worm forced Maryland's motor vehicle agency to close for the day and kicked Swedish Internet users offline as it spread.

"It mainly goes after PCs with a full-time connection to the Internet. In today’s connected world, that’s a lot of computers," said CBS News Technology Expert Larry Magid. "Big companies and universities have long had full time connections but so do a growing number of consumers who use a broadband service such as a cable modem or a DSL connection. Dial-up users are less vulnerable but not necessarily completely out of the woods.

"Unlike so-called "e-mail" viruses, you don’t have to do anything to be infected. The worm itself probes the Internet, looking for vulnerable computers to attack."

Security experts said users were lucky this time because LovSan is comparatively mild and doesn't destroy files. They worry that a subsequent attack exploiting the same flaw — one of the most severe to afflict Windows — could be much more damaging.

"We think we're going to be dealing with it for quite some time," said Dan Ingevaldson, engineering manager at Internet Security Systems in Atlanta.

Although LovSan did not appear to do any permanent damage, Ingevaldson said instructions to do just that could easily be written into a worm that propagates in the same way.

On July 16, Microsoft posted on its Web site a free patch that prevents LovSan and similar infections. The underlying flaw affects nearly all versions of the software giant's flagship Windows operating system.

Notwithstanding high-profile alerts issued by Microsoft and the Department of Homeland Security, many businesses did not install the patches and scrambled Tuesday to shore up their computers.

Security experts say patches often stay on "to do" lists until outbreaks occur.

"You're looking at 70 new vulnerabilities every week," said Sharon Ruckman, senior director at Symantec's research lab. "It's more than a full-time job trying to make sure you are up to date."

Microsoft spokesman Sean Sundwall acknowledged that the blame does not really lie with customers.

"Ultimately, it's a flaw in our software," he said.

The latest infection was dubbed "LovSan" because of a love note left on vulnerable computers: "I just want to say LOVE YOU SAN!"

Researchers also discovered another message hidden inside the infection that appeared to taunt Microsoft's chairman: "billy gates why do you make this possible? Stop making money and fix your software!"

Tracing its origins will be difficult because the worm left few clues, said Marc Maiffret, co-founder of eEye Digital Security. The worm appeared based on code released earlier by a Chinese research group that goes by Xfocus, Maiffret said.

Non-Microsoft systems were not vulnerable, though some may have had trouble connecting with Web sites, e-mail and other servers that run on Windows.

Among companies affected in Germany was automaker BMW, said spokesman Eckhard Vannieck. He said the problems did not affect production.

Symantec, F-Secure and other anti-virus companies have free tools for removing the worm.

All Windows users, whether their computers were infected or not, were encouraged to obtain a fix from Microsoft's Web site. Anti-virus and firewall products should also be updated, security experts say.

Larger companies typically have firewalls that can stem attacks, but once a worm gets inside a firewall, unprotected computers are vulnerable.

Employees connecting from home or taking infected laptops to the office can allow the worm to easily penetrate a company's defenses, said Russ Cooper, a senior researcher at TruSecure.

But to expect home users to keep their systems current is unreasonable, said Bruce Schneier, chief technology officer with Counterpane Internet Security. He blames software developers for writing bad software that constantly needs "critical" patches.

"My mother will never install the patch until I come visit," he said. "I couldn't even call her and walk her through it. The industry is wrong to expect her to do it. The fact that she sends me e-mail is incredible enough."

©MMIII CBS Broadcasting Inc. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed. The Associated Press contributed to this report.

Back To Top