Windows users--that is, more than nine out of every 10 computer users--have long complained of bugs and viruses. Using a Microsoft operating system required patience and vigilance, particularly if you want to keep up with the newest security patches designed to keep it safe from hackers.

Now Vista, Microsoft's new operating system, promises to alleviate many of these headaches with what Bill Gates calls "the most advanced operating system for security ever done."

Alas, that still doesn't mean Vista users can boot up their computer and stop worrying. "The reality is that this is really the most secure operating system that Microsoft has ever engineered, but you can't take it for granted that you will be protected," says Andy Walker author of the book Microsoft Windows Vista Help Desk.

In Pictures: New Windows, Old Problems

That's because the new operating system, five years in the making, is an enormous piece of software, which makes it potentially rife with security holes. And Microsoft's dominant market share means its users are a huge target for cyber criminals and miscreants. Vista is like a hacker's Mount Everest: Everyone wants to conquer the giant.

Microsoft had already released the first patch for the system, designed to fix a flaw related to the processing of Windows Meta File images before the consumer version of Vista went on sale. Joanna Rutkowska, a researcher at Singapore-based Coseinc, publicly hacked the operating system last August at the Black Hat security conference. In December, computer security firm Determina reported six vulnerabilities in Microsoft's new Internet Explorer 7 browser.

Expect more holes to appear over time. Rick Howard, director of intelligence at iDefense, a subsidiary of security company VeriSign , predicts a Vista-specific virus will appear in the next six months. His company is offering an $8,000 reward to the first six researchers who can find holes in Vista or the newest version of Internet Explorer. If they write code that exploits the weakness, they'll make up to $4,000 more.

These rewards are only a fraction of what a Vista vulnerability goes for on the black market. According to computer security researchers at Tokyo-based Trend Micro , underground hackers sell Vista exploits for $50,000 a pop.

Vista's biggest weakness is its lack of anti-virus applications. Windows Defender, a new Vista program, is pretty effective at nabbing spyware. But the new system lacks any kind of virus-catcher, meaning that consumers will still need additional protections. "[Vista] doesn't in anyway change the need to continue doing what customers have been doing, which is having a good security product on their operating system," says Rowan Trollope, vice president of Symantec's consumer products division. Consumers should pick up additional security software that includes an anti-virus program.

Trial programs of McAfee will be automatically included inside new Dell , Gateway and Toshiba computers shipped with Vista. Symantec runs the same deal with Sony and HP machines.

The security companies don't yet offer products for the 64-bit version of Vista, a result of their much publicized fight with Microsoft in the fall. They expect to get the codes allowing them to offer those products around the time Microsoft releases its first Vista Service Pack. Most consumers use a 32-bit platform right now, notes Symantec's Trollope, so it's not that much of a problem.

... "If customers believe they do not need to install any security products on their Vista PC, they will be just as susceptible as they were on XP to getting viruses," says Brian Trombley, Product Manager at McAfee.

Security experts also have a problem with the settings of Vista's firewall. Vista automatically blocks questionable inbound connections, preventing malware from sneaking into the system. But users have to turn on the outbound firewall to stop a virus that's already on the machine from infecting others. With the growth of botnets, networks of computers manipulated by cyber thieves unbeknownst to their owners, blocking unsafe outbound traffic is even more critical.

One new feature that security expects generally like is User Account Control, a protection system that allows different users to set up different accounts. UAC also stops unauthorized users from making some system changes or installing software without typing in the administrative password. More significantly, UAC is supposed to contain a malicious infection and stop it from infecting the entire computer. Vista users are encouraged to create an administrative account to oversee the whole computer, but work in a user account. If they run into trouble, the problem will be localized.

UAC also allows the system's administrator to monitor and limit an individual user's activities. This should appeal to parents, as it allows them to block specific Web sites, downloads, games and programs. Parents can also control what days and time their child can use the computer and get activity reports, showing what Web sites the kids visit, how long they're online and how many e-mail messages they get.

This kind of thoroughness, however, may be the system's undoing. UAC is a very chatty program. Every time a user tries makes a change, a pop up will appear asking for their approval. The program fails to distinguish between dangerous things users really shouldn't do and mundane changes like altering the date and time of the system. After a while, users may contract a case of security overload. They'll get tired of the constant pop-ups and just approve everything without even reading the alerts. "The virus writers and spyware writers will take advantage of that dialogue fatigue," says Walker.

First there was too little security. Now, users will complain of too much. When will Microsoft get it just right?