All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?
Each company will use a different scale, but they all will likely be the result of a weighted score considering:
Here is a similar scale: http://reviews.cnet.com/4520-6600_7-6274750-1.html
Symantec rates malware based on reputation and behavior classification and doesn't use a 'low-high' scale anymore.