I know some viruses repeat the same actions over and over again with no break, thus grinding the network to a halt. But others "take a break" from there repetitive actions.
For example Nimda performs it's mass mailing routine every 10 days. How does it know "10 days"? It can't create a file with the date it last done it, that would be a dead giveaway to AV's.
Another is the Sasser worm. It "Attempts to create a mutex named JumpallsNlsTillt and exits if the attempt fails. This ensures that no more than one instance of the worm can run on a computer at any time." Wouldn't this be a dead give away for AV's? What exactly is a mutex?