From the time AVG uncovered the infections, until it publicly released a report on the threat this month, the criminals had abandoned their attack, but not before lifting information including credit card and bank account numbers and passwords to e-mail accounts and social networking sites from an estimated 55,000 computers.