I used to do the same stuff, we didn't even see it as malicious back then, just a "prank" really. Most the people we "infected" were via IRC and ICQ, embedding the exe client into a JPG (or just changing the exe icon to a JPG one) and DCC'ing it to them.

Once infected, we'd screw around, make errors pop up on their screen like "Computer Is Low On Coffee, Please Insert Coffee Cup" then make CD tray eject, etc. Then we'd chat to them, and they usually had a good laugh, and we'd tell them how to not get infected in the future, then self-destruct the client.

We didn't really investigate it much or ponder the deeper implications behind it, so it took us a fair while to realise the level of maliciousness that was possible, which scared us off, so we stopped messing with it (we'd already been in trouble for other stuff so didn't want to push it!)