One thing though is software designed for newer versions of Windows that will still work on XP may use a newer folder structure or be hardcoded to use it even though it isn't normal for XP, so it's possible to have non-default locations for XP like that, although I've only seen that happen once when using a software.
I see in the history of my system that I have no trace of new installed applications at these dates
Creation date is 2008 at the day where I first connected to the internet. (and I installed my old USB ADSL Modem)
20140630 a index.dat in it has this creation date, it was last modified 20160118 and IndexDatSpy find it empty now
Then 20150628 I made the last clone back up of the partition (if I restore it, this folder should be empty)
20150920 is the first date when a subfolder appears in it (supposing none are destroyed)
The subfolders seem to be created every 2 days in average on the beginning, 4 ones at each date hour minute precises, sometimes 4 times a day and never let more than 6 days without creation.
I connect to the internet every day and start windows every morning too
All that, ended on 20151228 without apparent cause.
I am looking for a software wich give us an alarm when a new folder or a new file is created somewhere and at any moment. So it seemed that it is too difficult to manage a permanent low noise scan. Even Kaspersky seems unable to do that ! All scan is always a major use of the performance of the system as if it was a question of rapidity.