I haven’t done this last step, yet. I keep forgetting to start disk scanning when I go to sleep. 
But I had an idea to look for previous versions of explorer.exe, which I did not have. But it turns out it’s been modified.
The modification date is -before- the file creation date.
Creation date: 25. October, 2011. Which is pretty accurate for when I bought and installed this machine.
It claims it was changed 26th of February, 2011. But at this time I did not own the computer. 
I believe this might be a malicious change, which tries to mask itself by setting the change date earlier than the actual change? Or am I being paranoid here?