When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X?

Does AV Developer Y have a lab of computers actively trying to get infected? (Maybe by crawling the web and the least protected manner possible?) And if so, is there a general pattern that indicates an infection has occurred?

Or, does AV Developer Y wait until someone reports suspicious behavior? If so, how does AV Developer Y investigate and create a definition for Virus X?

... And who names the darn thing?