It's also worth pointing out that this wasn't a virus or worm, but a trojan. It still required that people type in their passwords. (It pretended to be an update to Flash.)