auditor: fix winXP path discovery