It can affect machines as well. Usually through an e-mail, or it tries to infect web server running IIS. Many back doors, but most normal people are safe as long as you don't visit a site that has been infected, and it runs the script on your machine, or as long as you do not open an infected e-mail with it.