We recently suggested that a customer use Filemon to find out which process was changing files. An MVP let me know that Filemon is now part of Process Monitor v1.12, which is available for download on the Microsoft TechNet website. Use the button at the top of Process Monitor named "Show File System Activity" to see output similar to Filemon's.

 --Jill