What I still haven't had answered is how does the infection actually spread? The bottom of this article says not to open email attachments, but also mentions closing certain ports. Is this being activated accidentally by the users or is it spreading by some exploit?