Where Windows malware hides
I found this really nice document from Roger Grimes - it is about how and where malware hides itself. Roger is also speaking about less known features like ADS or ActiveSetup - I highly recommend to check it out ;)
http://weblog.infoworld.com/securityadviser/archives/2006/05/where_windows_m.html