Using XP, AVG and Malwarebytes.

I run virus and malware scans at least weekly. Most of the time, there are no threats detected and no bad things to delete. When there are threats detected, Malwarebytes and/or AVG delete them. Where did these threats come from?

If I were told they came from a particular site, I would not visit that site again? If I were told they resulted from an action or inaction on my part, I would stop my bad behavior.

Is there any software which will identify the source of the bad things?