I’ve got your MEConfig.db, and am examining it. In the meantime, you can run a more informative version of the test you just ran. First, go to SysInternals[/url:2yg1deey”> and download the latest version of their free and excellent utility Process Explorer. Then repeat your experiment with Process Explorer active and watch when the RSH and compiler processes begin and terminate. That will tell you definitively what’s really active. You can also do this using Windows’ Task Manager, but it’s a much less powerful tool, and harder to quickly spot changes on.
For what it’s worth, Process Explorer is a must-have utility for many purposes, from debugging to system tuning, to compromise forensics. The SysInternals[/url:2yg1deey] site also has a number of other terribly useful (and free) utilities, as does [url=http://www.foundstone.com:2yg1deey]FoundStone[/url:2yg1deey”>. You may already know of both sites, but I always get posts out to point people to them as often as possible, as they’re rather amazing resources, with code written by some of the best people in computer security.