I haven’t done this last step, yet. I keep forgetting to start disk scanning when I go to sleep. :confused:

But I had an idea to look for previous versions of explorer.exe, which I did not have. But it turns out it’s been modified.

The modification date is -before- the file creation date.

Creation date: 25. October, 2011. Which is pretty accurate for when I bought and installed this machine.

It claims it was changed 26th of February, 2011. But at this time I did not own the computer. :stuck_out_tongue:

I believe this might be a malicious change, which tries to mask itself by setting the change date earlier than the actual change? Or am I being paranoid here?