I'm thinking maybe tlist from the reskit might help ... do a :

tlist | find /i "kix32" >output.txt

then parser back in and look for a cmd.exe running kix32.exe off your logon share (as opposed to of the workstation ?) - something like that - just an idea ...

-Shanw