If you are feeling ambitious, here's that link to Trend Micro's HijackThis:
http://download.cnet.com/Trend-Micro-Hijac...4-10227353.html
Because so many malware programs imbed themselves in registry operations that occur *before* your operating system starts up, they are able to place themselves in areas that your spyware scanners and AV programs can't identify or remove them because they load after the OS starts. That's why rootkit removal programs operate in a "OS shell" environment to work independently, and why you typically need to know in advance that you *need* the rootkit and have the malware pre-identified.
With HijackThis, you receive an analysis of not ony your registry but all operations (visible and hidden, not just the ones shown on Window's "Taskmanager") going at the time of the scan (which takes seconds to do.) Which looks something like this (from the CNET screenshot of an older version as a sample):
The coding is a bit intimidating at first, because as I mentioned before, the program wasn't intended for the "casual/layperson" type of user. Essentially each operation listed can be corrected or terminated and any associated coding would be removed from the registry by clicking on the checkboxes and choosing an action. Because of the sheer power of the application (to clean things manually that other malware scanners cannot, but also to do severe damage to your computer by eliminating key operations to Windows) it was intended to be used by those with some working knowledge of computers.
The good news, though, is that the learning curve is very shallow and the average computer user can become an expert very quickly using online resources to look up the individual operation codes, thanks in large part to anti-malware communities like the late
CastleCops, so there are user-databases that can identify all codes just by doing cut-and-paste and using their search functions:
http://www.systemlookup.com/lists.php
The other good news is that nowadays, makers of "bonafide" computer operations (Microsoft, Lavasoft, Real, Roxio, Soundblaster, Adobe, etc. ...I'd include "Apple" but iTunes itself is an insidious virus in my opinon LOL) :p actually put identifier tags on their registry operations, so it is much easier to identify those fake installed-operations that pretend to be Microsoft, Norton AV, etc. In fact, in the Vista and later OS versions of Taskmanager, a lot of these official tags show up to differentiate the processes.
So essentially you run the program, generate the report (similar to above), look at the various sections (O2, O3, O4, etc.) then look for things that stand out that you cannot recognise. For these you use the reference link and copy-and-paste that {code-code-code} into the reference and see what comes up for the questionable items.
Just go slowly and don't delete anything unless you know for sure what it is (or what it isn't) supposed to be, or post your report log on one of those online forums for an expert to help analyse your processes.