Try ProcMon to get a better idea of what's really going on when it happens.