Criminal malware surges as virus threat fades