win7: c:\windows\tracing
%windir%\system32\logfiles\
C:\Users\Administrator\AppData\Roaming\soft
C:\Users\Administrator\AppData\Local\Temp
C:\Windows\Resources
C:\ProgramData\Microsoft\Windows\Start Menu
c:\windows\win.ini
C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs