Some are just vandalism, others are made to create bots that can be used to attack companies/web sites for any number of reasons. IMO the ones you are most likely to see today are made for profit. These do things like harvest personal information that can be sold to advertisers or used for identity theft, try to sell you stuff, or spawn pop-up/redirect your browsing/searches to web sites paying them for the traffic.
The toughest types of malware to prevent tend to be when an otherwise trustworthy site is hacked so it injects Trojans to people who visit, or infected banner adds that site owners don’t control.
While anti-virus is important a good firewall that requires applications to have permission before allowing them to connect to the internet is more valuable because it won’t allow a Trojan to send personal information back out.