Six,
Just curious TD, what is their (the malware developers') end game?
This is just my opinion, but I think there are two primary motives. The first is just destruction for it's own sake. These people are almost always males in their late teens or early twenties with nothing better to do. They're amateurs.
The second motive is monetary. This is a more sophisiticated class of malware author because they apparently make their living off of their illegal activities. And the most common of these activities appears to be tied up with the proliferation of spam. The purpose of the malware is usually to gain control over the infected machine (Preferably a whole network of infected machines) so that spam can be sent or DOS attacks launched. Obviously, malware that calls attention to itself makes this more difficult, so these creations are designed to be as invisible and cause as little damage as possible. The goal is for infected machines to stay infected as long as possible.
I used to be a little envious of people that have discovered new "in-the-wild" malware. Now, it's no big deal. There's nothing unusual about finding an email attachment (Or sometimes even a running process) that is malicious but doesn't generate a positive with any of the major AV vendor's products. When you submit a sample for analysis and confirmation, the reply goes something like this:
"Thank you for your submission. Our technicians have analyzed the sample and can confirm that it is definitely malware. We've designated it, M al/EncPk-AC. Future updates will detect this virus."
The "AC" clapped onto the end of the name is the variant designation. The AV vendor in this example (Sophos) starts at 'A' and goes through the entire alphabet, then they start over with 'AA, AB, AC' etc.' Each time a new variant of the same virus is found a new signature is added. And each time a new signature is added, malware authors create another yet another new variant that won't be detected.
They've also discovered that limited releases of multiple variants at once gives them a longer useful life. In other words, infected machines will stay infected longer.