Emacs Lisp Virus

It can be done. See the documentation for SES21 (Simple Emacs Spreadsheet) that explains counter-measures against such a thing. AFAIK, it's never actually been done, though.

How would one go about doing it? I have seen documents with autorunning Elisp code embedded, but Emacs asks me whether I want to run them.

Do you look at the code before saying "yes"?

Yes, of course. Point taken, though