Thanks for your support!
Here's the thing with AV signatures, and the way Symantec/Norton works.
Symantec does not write signatures for EVERYTHING. If you tried to match every single file, application, and action on your computer to a set list of "known things OK" or "known things BAD"; it would completely consume the horsepower of your machine. Symantec does write/release signatures for a LOT of things. However, they also write and maintain normal behaviors for normal operation. If something happens that is abnormal from known good operation, it triggers scans, firewalls, quarantine, etc. etc. based on how you have your software configured. This is known as taking an offensive approach as well as a defensive approach to computer security. Symantec has THE largest GIN (Global Intelligence Network) with umpteen thousand sensors and endpoint clients throughout the world. They get a pretty good fix on what's going wrong and what's going right in computer security.
Several of the other leading vendors, including McAfee, Trend, and Kaspersky are right up there as well.