D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
D:\Documents and Settings\LocalService\NTUSER.DAT
D:\Documents and Settings\LocalService\ntuser.dat.LOG
D:\Documents and Settings\username\Application Data\Microsoft\IMJP8_1\imjp81u.dic
D:\Documents and Settings\username\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
D:\Documents and Settings\username\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
D:\Documents and Settings\username\NTUSER.DAT
D:\Documents and Settings\username\ntuser.dat.LOG
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
D:\Documents and Settings\NetworkService\NTUSER.DAT
D:\Documents and Settings\NetworkService\ntuser.dat.LOG
D:\pagefile.sys
D:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf
D:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
D:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf
D:\WINDOWS\SchedLgU.Txt
D:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb
D:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.chk
D:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log
D:\WINDOWS\system32\config\AppEvent.Evt
D:\WINDOWS\system32\config\default
D:\WINDOWS\system32\config\default.LOG
D:\WINDOWS\system32\config\SAM
D:\WINDOWS\system32\config\SAM.LOG
D:\WINDOWS\system32\config\SecEvent.Evt
D:\WINDOWS\system32\config\SECURITY
D:\WINDOWS\system32\config\SECURITY.LOG
D:\WINDOWS\system32\config\software
D:\WINDOWS\system32\config\software.LOG
D:\WINDOWS\system32\config\SysEvent.Evt
D:\WINDOWS\system32\config\system
D:\WINDOWS\system32\config\system.LOG
D:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\IMJP8_1\imjp81u.dic
D:\WINDOWS\system32\wbem\Logs\wbemess.log
D:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
D:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP
D:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP
D:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP
D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA
D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP
D:\WINDOWS\system32\wpa.dbl
D:\WINDOWS\WindowsUpdate.log