The next time, you get a Christmas greeting in your e-mail, better watch out!

A variant of the ZAFI worm, ZAFI.D is going around in the disguise of an X'mas greeting and infecting mail boxes the world over. The virus is a major threat to home PC users.

Attachments appear at 12 KB in size. Once inside the infected system, the worm drops a copy of itself under a legitimate-sounding file name.

Antivirus firms like Trend Micro and McAfee have issued a medium risk virus alert to warn users of the worm that has been sighted in France, Germany, Spain and now in India.

This worm arrives via email and through peer-to-peer networks bearing the message of 'Happy Hollydays' and the subject line 'Merry Christmas,' and will appear to be from someone the recipient knows.

The worm is attached in a file that pretends to be a holiday postcard greeting (for example "postcard.index").

The message may appear in different languages based on the recipient's country domain.

The worm copies itself to directories on the C: drive containing one of the following strings: 'share', 'upload' or 'music'.

It sends itself out in English, creates a registry key, so that infected files are executed every time an infected computer is turned on.

ZAFI.D can also search for directories of anti-virus and personal firewall software, and then overwrite the executables with a copy of itself.

To protect your PC from the worm, antivirus firms like Trend Micro offer the latest pattern file, number 2.297.00. Customers of Outbreak Prevention Services can download OPP 137 (or later) to help protect against spread of this threat.

Users can also use Trend Micro's online virus scanner, Housecall, which can be found at http://housecall.trendmicro.com/