Email users are still being tricked by Zafi.d, the mass-mailing Christmas e-card virus that keeps topping the malware charts

The Christmas card worm -- Zafi.d -- is still dominating the virus charts, as people continue to report having run the program thinking it was a seasonal greeting.

Zafi.d, which in its third month at number one in the Sophos virus charts, contains a Trojan horse program that gives hackers remote control of an infected PC. Sophos found the Hungarian-written worm accounted for one in three viruses detected.

February's top ten, published on Wednesday, was dominated by old viruses and contained only two new entries -- Bagle-BK and Sober-K.

"It looks like the Zafi-D worm is going to be hanging around like a bored teenager for some time to come," said Carole Theriault, security consultant at Sophos. "Bagle-BK is the latest incarnation of the Bagle family of worms to make an impact, fooling many people to open its unsolicited email attachment. User education, good anti-virus software, and a sensible email policy can make worms like this an irrelevance."

The Sober-K worm is sent under a number of guises, including a bogus email from the FBI and message promising explicit videos of celebrity pin-up Paris Hilton.

But overall virus reports took a slight dip compared to last month's figures, when 1 in 23 emails were viral.

The top 10 viruses for February 2005 were as follows:

1. W32/Zafi-D: 30.8 percent (Third month at number one)
2. W32/Netsky-P: 22.3 percent
3. W32/Zafi-B: 9.7 percent
4. W32/Bagle-BK: 5.2 percent (New entry)
5. W32/Netsky-D: 4.2 percent
6. W32/Netsky-Z: 3.8 percent
7. W32/Sober-K: 3.4 percent (New entry)
8. W32/Sobig-F: 2.5 percent (New entry)
9. W32/Netsky-B: 2.4 percent
10. W32/MyDoom-O: 1.5 percent

Copyright © 1995-2009 CBS Interactive Limited. All rights reserved
ZDNET is a registered service mark of CBS Interactive Limited. ZDNET Logo is a service mark of CBS Interactive Limited.