@Henry Cobb: Yep, that's about right

"Symantec isn't expected to be able to spot it by themselves?"

Actually, they're not. No one expects Symantec as a company to detect and analyze this code, and release an update to catch it. Let alone remove the thing.

People buy Symantec AV with failure in mind. "Every­one else believes anti­virus soft­ware must fail to stop some viruses — and so they build failure into their 'solutions.'" -- Rob Rosenberger

http://www.vmyths.com/column/1/2004/7/2/