Virus scanners can only catch known threats or their derivatives (is that the right word ?), so if an enterprising hacker creates something knew, the scanners won't catch it.
BTW if I'm wrong on this I'd love some education. I assume this is how it works; scanners only know what to look for because of a database and the way they act. If there's more to it than that, I'd love to learn