There is also this one to help detect

http://support.microsoft.com/kb/312444

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
PendingFileRenameOperations