I actually consider the Sony BMG rootkit as the beginning of commercial malware. The antivirus companies knew it existed, but did not flag it partially because it was by a legitimate company with a legal department, and not an unknown developer or dubious organization like viruses up to that point.