Look at you last hjt log, print it out.

Compare it to new logs.

AV, firewall, Super, 'Bytes and what was given me at birth are what I use.

SAS and bytes, run weekly until you get the feel of them and compare each's log to teh clean logs above.