Last month saw the outbreak of the Sasser worm, but Netsky and its variants still caused huge numbers of infections in May, according to research.
Antivirus company Sophos said that Sasser accounted for 51 per cent of infections last month, with Netsky variants filling four places in the top five.
But Trend Micro barely registered the Sasser worm, with the E variant squeezing into eighth in its top 10, while Netsky dominated.
"Sasser had a massive impact as it hit home and industry users alike," said Carole Theriault, security consultant at Sophos.
"It was huge this month; basically if you hadn't patched up you were going to get it. Older worms are still hanging around, but Sasser had us rushed this month."
Overall all antivirus researchers noted the increasing use of variants as hackers adapt others' code.
But there was disagreement over the rate of new viruses, with Sophos reporting May as the busiest month for new viruses since 2001 and Trend Micro suggesting that rates were dropping.
But it is not just worms that make the lists this month. Panda Software has reported that Trojans such as Briss.A and Downloader.L are spreading fast via email and peer-to-peer file sharing.
Once installed, these activate immediately to download more malicious code and could allow the infected PC to be used for spamming or denial of service attacks.
All three vendors warned that antivirus software alone is not an effective defence against modern viruses that use a variety of propagation mechanisms. The vendors recommend beefing up defences with a firewall and other protection systems.
Microsoft seizes control of phishing sites linked with Russian state hackers
Fitness trackers over-estimate the number of steps their users take, analysis of 67 research reports suggests
Everything we think we know about the imminent Apple iPhone 9, iPhone 11 and iPhone 11 Plus launches
All the latest rumours about Apple iPhone Displays, CPUs, launch dates and even prices
Nvidia brings Turing microarchitecture into the high-end gaming segment