I am working on a FIM project right now and am going over some files I often see popping up in our reports. Three in particular are of interest to me:
C:\WINDOWS\system32\drivers\VirtFile.sys
C:\Windows\System32\DRVSTORE\VirtFile_BEECE804497C13681B...