Just checking files users have write access to and i'm a little suprised with these two:

c:\windows\system32\mfc71.dll
c:\windows\system32\msvcr71.dll



XP SP3 on a domain environment