G-BOY, my advice (and what I do when a customer gets me to set up a Windows box for them) is to install and run HT before anybody gets the chance to start scr*wing things up. I rename the log file it produces to include the date, so it doesn't get over-written by subsequent runs of the program. Having a base-line "known good" list of what's installed and running makes cleaning up a spyware infection a hell of a lot easier.
The HijackThis.de analyser is a useful adjunct to my own experience in helping me decide what to delete, but is no substitute.