What are the AV vendors doing???

Here you can see 2 virustotal links (they are safe to visit):

Virustotal - sinowal
It is a variant of a well known malware, Sinowal (Torpig, Mebroot). It is developed by the Russian Business Network, for pure evil purposes: steal credit card and netbank login information. 18% of the AV vendors detected it at the time of scanning. There is no day without a new variant of Sinowal. The question is: For what do I pay if I buy any of the well known AV solutions???

And the second:
Virustotal - meterpreter
It is a super-trojan in my point of view. It is open source, you can customize for your purposes, and can do almost anything you want. And hey, it is part of the metasploit project, called meterpreter. Results: 7.69% detection rate.

And yes, I use Linux and OSX on a timely basis, but I have to use Windows for my daily job as well. And you know what? I'm really scared...

Hey Z,
I understand your worries concerning Mebroot variants,
but since Meterpreter is only a tool for creating scripts AVers can't take the signature from the tool (or maybe as an "hacktool", best they can do) or it will only be detected on the hackers boxen, to be effective they have to take a signature from the generated scripts that is present on the hacked machine, pain in the arse since you do what you want as script.
Add to this that AV mainly detect a malware from signature than from behaviour...they don't have it ? they don't see it. 8)

The second executable, which I called meterpreter, was not the tool to create the malware/trojan, but it was the trojan payload itself. And yes, signature based scanning is dead, but that is the point of my question: if it is dead, why dont they do their job well? I dont care if they run the malware in 60 simulated environment in order to detect whether it is harmful or not, but do their job: protect the users against malware. Nowadays AV tests like with words 100% makes me cry...

Well it's entirely a business and economic model question... Efficiently stopping a malware doesn't help selling AV, pumping up detection rates does. The real question is, is it intentional. Imho VXers are doing a far better job all things considered than AVers: messing with winternals while staying stealth is a bit more complicated than detecting false positives once a day to catch users attention, slowing a system by checking sig updates in antarctic and simply deleting whats considered as "malicious"..but the latter ones are the good guys, aren't they ?