+1 for Process explorer. However it is likely that explorer.exe has the handle open on that file. If that happens to be the case, we will have to use latest dbghelp.dll, configure symbols server and look for the threads with most CPU cycles to get an idea.