There is always someone who will trustfully run any script, no matter where he gets it from. His worm used a known sendmail vulnerability to get access to other hosts. In case of miss, the virus tried it with with rexec, fingerd and password guessing. After the successful break in, it compiled the source to make a local binary and executed it. If it was not, administrators had a much tougher job on cleaning the systems than the few days they needed to get things under control.
Internet Worms are viruses that use known exploits to gain administrator privileges.
But such are short-living stars that exist only until the exploit has been fixed, because they loose the media which they need replicate themselves and infect more systems. Exploits are very dependent on the version of the software, even on the architecture, and they hardly spread on different platforms or even on the same platform if other computers do not have the same version of the software. Faked libraries Of course, you can always play on the user's foolishness. This code takes over open and execv and modifies them to print out what they do and then jump to the real functions. This is just an example which does not hurt anyone, but demonstrates the principle.