I discovered a <img src=/S/free.gif border=0 alt=free width=30 height=15> app called Spy-The-Spy from http://www.mediachance.com/free/spythespy.htm that shows any changes to folders/directories that I monitor in real time. This recently helped me see an app try to put an advertising module into my Windows folder during a software install, as I've described elsewhere here. It has been running for about 1 week now without problems.