A dramatic increase in the number of virus-infected emails in UK businesses was recorded during 2001 with the most evil being Sircam, according to two surveys released this week.

Statistics for the year kept by antivirus firm MessageLabs, and recorded up to the second week of December, revealed that one in 370 emails scanned were infected, compared with one in 700 for the previous year.

According to figures from security company Panda Software, the top 10 most prevalent viruses in 2001 showed that Sircam was the major villain of this year.

The worm made up 24 per cent of all infections with the runner-up being Disembowler, which was reported in 18 per cent of cases. It means that over 40 per cent of virus infections during 2001 were caused by the Sircam and Disemboweler viruses.

The top 10 list, based on the number of reported or detected virus occurrences, is compiled using data from technical support services in 45 countries, and this year's figures suggest that two clear trends are emerging.

Viruses like Badtrans, which cause initially explosive epidemics and massive amounts of publicity, disappear in the course of time; while those like Hybris or MTX maintain a constant level of activity over a long period.

The infection techniques used by the virus writers play an important part in determining how persistent it will be. Those that use 'social engineering' and trick the user into running a file containing malicious code tend to maintain their presence in the list of frequently detected viruses.

While those like Nimda, which exploit application vulnerabilities, tend to disappear as users apply the appropriate patches.

This year has been marked by the extraordinary virulence of malicious code like Sircam and Nimda, and more recently by the epidemic caused by Badtrans B.

The tenacious nature of viruses such as Hybris and Navidad, which first appeared over a year ago, has also been a cause for concern throughout the year.

MessageLabs, which now scans over three million emails per day on the internet, intercepted an average of 3.3 email viruses per minute throughout the year, or one every 18 seconds. In 1999, the rate was one an hour; in 2000 one every three minutes.

The number detected and stopped was 1,628,750 versus a mere 184,257, from an admittedly smaller number, being scanned in 2000.

"2001 is the year of the virus," said Mark Sunner, chief technical officer at MessageLabs. "As virus writers get more sophisticated the trouble they are able to cause is much greater. If we thought the scale of the LoveBug [virus] was bad last year, then 2001 was characterised by the range and ingenuity of viruses."

MessageLabs trapped one virus-infected email per hour in 1999 and one every three minutes in 2000, so the 2001 figure represents a tenfold increase on the previous year and a 200-fold increase on 1999.

The MessageLabs top five viruses and their occurrences were: SirCam.A (37,523), BadTrans.B (258,242), Magistr.A (152,102), Goner.A (136,585), and Hybris.B (90,473). Worth noting are the prevalence of BadTrans and Goner, both of which are less than two months old.

MessageLabs said that on 4 December it trapped the Goner virus in one in every 30 emails, making it the fastest spreading ever.

Here is the Panda Software top 10 listed by rank, name and percentage of all infections:

1. W32/Sircam (24.2)
2. W32/Disemboweler (18.1)
3. W32/MTX (12.5)
4. W32/Hybris (9.4)
5. VBS/Help (8.3)
6. W32/Magistr.B@mm (8.07)
7. W32/Navidad.B (5.6)
8. W32/Badtrans.B (5.1)
9. W32/Nimda.A (5.09)
10. W32/Nimda.D (3.3)