Another sysinternals tool that may help is process explorer:
http://www.sysinternals.com/Utilitie...sExplorer.html
I've used this to ID processes that I don't want running, and it shows the full path to the executable and the publisher. Look for processes (such as svchost) that are launching from unusual directory locations or from unexpected publishers.
Generally, the .dat files in the location you mention are information files used by applications to store setting information and such--like cookies. When you delete them, the applications associated with them suddenly lose their memory about settings you made.
