Where are often the disk is written to the Trojans?

C:\Documents and Settings\ (in Win7 - C:\Users)
C:System Volume Information\; (D:\ and other drives - especially if they are included)
c:\RECYCLER\ and C:\Recycled\ (in Win7 - C:$Recycle.Bin, and on other drives)
C:\WINDOWS\system32\
C:\WINDOWS\Temp\ is already depends on where there is a folder like that.

NorthSouth
In the folder C:\Users\%user%\AppData or say C:\Users\%user%\AppData\Local there should not be executables, such as taskhost.exe.

The registry often. Order them from Ted to dig out, just need to be familiar with it.

Well, for a scan registry for lazy bend. Or scan just Smokes! rootkits.

That's not all

APP TEMP,WINDOWS,APPDATA

in fact, they do not care where to stand - as the hacker will solve, so they will try to established - in any case trying to program so that immediately they were not visible - they are Trojans quietly stand on the sidelines and steal the info, sending in the command center

Top Brown
Put in Fonts.