Zafi.d December's top virus

Kaspersky Lab said the Zafi.d worm was nearly 30 percent of all malware captured last month, making it the month's top virus by nearly a 12-percent margin. Mytob.c, which had been Kaspersky's virus leader in recent months, fell to second place, accounting for 17 percent of all captured viruses. LovGate.v appeared in third place, with 6 percent of all captures.

The Sober.y worm, set to enter its second stage today, rose by nine places from November to reach fourth place, despite hibernating in mid-December.

Shane Coursen, Kaspersky senior technology consultant, was unsure how widespread the anticipated Sober activity would be.

"Sober did drop off in the middle of the month. Then there's about a month until the update comes around," he said. "A lot of the URLs have been shut down - not all of them though."

Rounding out the top five was the Zafi.b worm, which, while taking in nearly 4 percent of the month's share of viruses, moved up 13 spots on Kaspersky's list.

Coursen said the list had little activity in the closing weeks of the year.

"Not much was going to happen," he said. "This was pretty much set in stone about a month ago."

Late last year, security experts have warned that the virus count rose with "alarming force," increasing from 110,000 to approximately 150,000 by year's end.

According to an analysis from security firm F-Secure, this steep increase in overall number of viruses was accompanied by a fall in the severity of mass assaults using network worms. The study noted that there were only two major outbreaks during the last six months of 2005: one in September, with the Zotob worm, and the second, Sober-Y, in late November.