The message is embedded in the Trojan's binary file.
If there's a silver lining here it's the fact that the Trojan-makers felt confident enough of their abilities to escape detection to create the message in the first place -- and then acted on the impulse.
While Zeus has been especially aggressive lately, including a wariant's ongoing attack against government sites, according to WebSense, its makers obviously feel willing to make some effort to call attention to themselves and their contempt for the a/v industry.
That's the sort of behavior, we can hope, that indicates overconfidence, and which could prove to be a chink in their elusiveness.
"Bring it on!" is what they are saying, and taunting a/v makers so openly would seem to insure that the Trojan-hunters will continue to.