Let's say one of the users on my home computer opened a questionable executable / image / document or allowed a questionable website through NoScript. I'm sure it's possible to have malware (or a rootkit) installed and running on your computer that does not present any sort of unusual behavior but still keylogs / sniffs packets / whatever. However, how likely is such a scenario (except for Sony rootkits)? How likely is it that your computer is running a very covert bot?
If you suspect your system might have been compromised in spite of the lack of symptoms, what tests can be run or what steps can be taken to improve a reasonable user's peace of mind? Avira Rescue System, NOD32, Comodo Firewall, Spybot, HiJackThis - anything I could add to that?
I know questions about malware are rampant on SU, but I am specifically interested in experiences people have had with intrusions showing rare and subtle symptoms.
Yes, I am paranoid. Help set me straight.
Note: This is now a community wiki.