"During the month of April, several older viruses maintained their spot on the chart," Gregg Mastoras, senior security analyst at Sophos, said in a statement. "The Zafi family of viruses accounted for more than 50 percent of all the viruses reported to Sophos this month. It could be that many of these worms were able to spread in multiple languages, therefore catching some users off guard."
Zafi-D is a mass mailing worm and peer-to-peer worm that creates a number of files in the Windows system folder. Some of these are exact or zipped copies of the worm, detected as W32/Zafi-D, while others are log files created by the worm. The virus harvests email addresses from the Windows Address Book and from files found on the hard drive. It can be recognised by the way it displays a fake error message box with the caption "CRC: 04F6Bh" and the text "Error in packed file!"