Number one is probably not even so far fetched - social engineering is a more likely vector than an actual virus, though. Ie...bailouts etc.