Google is doing the minimum that they can get away with - only removing known "bad" apps. To me this is a major flaw with their implementation of a Market Place - folks might not like Apple's draconian, and frequently changed, "editorial controls" on iTMS - but you've got to admit that it does give a feeling of security to know that someone has reviewed the app.
The fact you can install from many websites, doesn't necessarily mean that you should - that AllowInstallOfNonMarketplaceApplications setting is switched to off by default for a reason!
And not only is it possible for such malware to be written, some already has - there was that fake bank app that got pulled by Google a while ago, and there's been reports of a pretty nasty rootkit/trojan that was shown at some 'black hat' conferences about a month ago.
Hmm, to answer the last question first - a google search of "android antivirus" will throw up a couple of hits - including some free products.
I have severe doubts over the efficacy of such AV products - remember that Android is a Linux box at heart, so usually you won't have root permissions anyway - so that's conventional viruses stopped dead - the worse thing a bad program could do would be to delete your saved files - music, video and docs. And I'm only 50/50 sure that it could even go as far as to delete programs you've added (which should be an easy attack to fix - just redownload them).
No far worse than a mere virus are the trojans that steal personal information. However - as noted elsewhere - if you take a note of the install permissions requested then that should start some alarm bells ringing - why is a game asking for SMS access or access to your contact list? Okay, it could be a genuine mistake by the developer, (being sloppy), or it could be an indication of something bad? I'm doing a big anti-malware project in the office at the moment, and a project manager there came up with a good saying ... "smart software is not a remedy for dumb users". So rather than antivirus, I'm thinking that firewall would be better - especially one with a default of deny-all. 
Best firewall out there seems to be DroidWall (free!) but it also looks like it could be a bit tricky to configure - so if you're expecting a Norton style interface then prepare to be disappointed. Good thing about that is that it appears to just be a front-end for the iptables filter that Android already has inside - so minimal extra performance hit (I guess).
Hope this helps. Bob
0online
1876516posts