Detect what process is changing a file on Windows

Solution 1:

Both procexp and procmon are good for this. If the process holds a handle to the file in question then just run procexp and choose "Find Handle or DLL" from the Find menu then type in part of the file name you're searching for.

Alternatively (and as mentioned in the comments to the question), to use procmon to find, for example, a file called readme.txt open the filter dialog and set the filter as so:

Then press the Add button. Make sure there are no other processes that are excluded that might be touching your file.

Then start capturing events and sit back and wait.