To me, malware like this sort of shows the practical limits of securing desktop machines. If a user is willing to TYPE IN THEIR OWN PASSWORD in order to run a piece of malware, there is simply no way we can protect their machine from infection without completely taking away the user's ability to install software. There's a limit to how much we can do to protect users from themselves.
I agree, I personally have a bit of issue with calling this "malware". That and my general disdain for buzzwords and those who use them dictate this hesitation.
A friend's Mac was exhibiting symptoms of taking forever to find a website, but moving quickly once the site was loaded. I suspected DNS trickery and changed his DNS entries to OpenDNS. I'm sure this could have been the culprit!
If this was the culprit, the dns changes you made (pointing to opendns) would be over written the next time the cronjob executed. So he would be back to square one again.