Might want to add the %windows%\repair folder to the list of saved items, and may add the recent DLL UDF to help quickly check DLLs added/removed recently instead of the entire file system check which can be done but would take longer. Often spyware/trojans/worms add new DLL and Process which a compare will help to remove.