depends on the virus. Some actually search documents on your computer (word docs, html files, ect) and can extract email addresses from that.
The trouble is, most people dont want to have to type in an email address when they send someone an email, so the address book is needed.