How AV vendors look at and categorize New Viruses
F-Secure's weblog entry shows the code design and structure for a virus with comparisons of similar and dissimilar designs. Intially, the Buchon virus was thought to be part of the Netsky family but after modeling the code it is now a brand new virus family.
http://www.f-secure.com/weblog/#00000321