They install routines to change affiliate link codes - Affiliate Link Theft is becoming big business, and I seem to remember a company that did this was traded for multiple millions recently.
They also create a lot of traffic which gets sold to people trying to boost ailing tgps.
The fact that Norton picked up incoming files isn't really important. A virus installer sitting in your temp directory is harmless and pretty common these days. It only becomes a problem when it gets triggered. Anti-virus programs like avg detect trigger activation, and thus have a better success rate than the AV programs that just rely on scanning files for virus signatures.
It's because of the detectors that are placed on trigger points by AV programs that you should never install more than one. They can interfere with each other and make both less effective.