It was claimed that the unclean version could escape from a virtual machine and delete boot records, which is what you're describing as the "worm" and whatnot, but I actually contacted oracle (the makers of VMBox) about it because that would mean there's a vulnerability they need to fix, and they said that if it was actually true, that they would contact me back about it. They haven't contacted me back.
