What I would expect:<p>* fewer crappy apps running on startup<p>* improved startup time<p>* no unknown apps running after a clean boot<p>(Previous 3 can be monitored with e.g. SysInternals AutoRuns)<p>* no browser / networking stack hijacking extensions showing popups / interstitials / DOM modifications etc. at random intervals<p>(As evidenced by e.g. HijackThis)<p>* no unsigned DLLs / drivers of unknown provenance loaded in any process or the kernel<p>(As evidenced by e.g. Process Explorer's Verify Image Signatures option - look in loaded modules of the "System" process to see all loaded kernel drivers and modules), with a representative sample of applications running (browsers, productivity, etc.)<p>* no apparent rootkit-style hijacking of the process / registry / disk inspection routines, as would be shown by e.g. RootkitRevealer<p>And of course, a commercial virus scan, for what it's worth. I personally don't run a real-time virus scanner; I rely on monitoring what the system is doing directly.