When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X?

This answer to this question gives a brief list of high-level ways the virus can be found:

• Samples are sent in by customers
• Malware detected by heuristic scanners (i.e. stuff that behaves like a virus) is further analysed
• Mail blocked as spam can be analysed for malware attachments.
• "honeypots", which are public servers or email addresses designed to collect malware
• going undercover in malware writers communities

But, what's are the specifics? Are the non-customer initiated means of collecting viruses completely automated? Or, are there N people in a lab trying to contract something?

What heuristics / behaviors lead to a more in depth analysis? And what does the more in-depth analysis consist of? What's the "final marker" of a virus?

... And who names the darn thing?

When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X?

This answer to this question gives a brief list of high-level ways the virus can be found:

• Samples are sent in by customers
• Malware detected by heuristic scanners (i.e. stuff that behaves like a virus) is further analysed
• Mail blocked as spam can be analysed for malware attachments.
• "honeypots", which are public servers or email addresses designed to collect malware
• going undercover in malware writers communities

But, what's are the specifics? Are the non-customer initiated means of collecting viruses completely automated? Or, are there N people in a lab trying to contract something?

What heuristics / behaviors lead to a more in depth analysis? And what does the more in-depth analysis consist of? What's the "final marker" of a virus?

... And who names the darn thing?

When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X?

Does AV Developer Y have a lab of computers actively trying to get infected? (Maybe by crawling the web and the least protected manner possible?) And if so, is there a general pattern that indicates an infection has occurred?

Or, does AV Developer Y wait until someone reports suspicious behavior? If so, how does AV Developer Y investigate and create a definition for Virus X?

... And who names the darn thing?

When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X?

This answer to this question gives a brief list of high-level ways the virus can be found:

• Samples are sent in by customers
• Malware detected by heuristic scanners (i.e. stuff that behaves like a virus) is further analysed
• Mail blocked as spam can be analysed for malware attachments.
• "honeypots", which are public servers or email addresses designed to collect malware
• going undercover in malware writers communities

But, what's are the specifics? Are the non-customer initiated means of collecting viruses completely automated? Or, are there N people in a lab trying to contract something?

What heuristics / behaviors lead to a more in depth analysis? And what does the more in-depth analysis consist of? What's the "final marker" of a virus?

... And who names the darn thing?