Microsoft's SP2 won't cure all security ills.

In the escalating cybersecurity war, Windows XP Service Pack 2, or SP2, represents a small advance for the good guys. Microsoft issued its most security-focused software update Aug. 6. Experts recommend using it to enable a basic firewall and to access free Microsoft security patches. But SP2 might never reach many of the 210 million Windows XP machines already in use, because PC users usually ignore service packs. SP2 does not apply for users of hundreds of millions of PCs running Windows 95, 98, NT, Me and 2000. Microsoft's advice to users of old versions of Windows: Buy a Windows XP machine with SP2 installed. SP2 is notable for something else it lacks: anti-virus protection. Because the Windows operating system runs 92% of the PCs connected to the Web, some in the tech industry wonder why Microsoft hasn't tried to supply a base level of anti-virus protection free to Windows users. Instead, the software giant is taking steps to become another supplier in the already-crowded anti-virus retail market. Since purchasing Romanian anti-virus maker GeCad last year, Microsoft has been developing an anti-virus product to sell to consumers and businesses on a subscription basis.