Re: System Restore folder using enormous amount of memory

R. McCarty said ...
> FileMon will show the ownership process that creates or accesses
> a file. The intent was to see if SR was adding the .Sys module or a
> another "Rogue" process was doing it. In other words, Filemon will
> create a running log - by doing a manual Restore Point you can go
> back through the Filemon log and locate the creation of this 800
> megabyte file and the process that created it. Use the Right edge
> Scroll bar to review the log file.
>
understood ... but ... the changes seem to happen either on closedown or
on startup at which time filemon won't be running. Unless you can tell
me how I can have filemon running at those times - I can obviously keep
filemon running as I close down but of course it will get stiopped at
some point and its log gets lost if I haven't savwed it (v large log to
say the least!!).
--
Wilf
.