have you checked the windows security log, for the time that it last ran, to try and isolate an account that might have been used to kick off that process. also ask your wintel team about server level tracing/auditing that they perhaps could put on temporary for a month or so.
--------------------------------------------------------------------------------------
[highlight]Recommended Articles on How to help us help you and[/highlight]
[highlight]solve commonly asked questions[/highlight]
Forum Etiquette: How to post data/code on a forum to get the best help by Jeff Moden[/url]
Managing Transaction Logs by Gail Shaw[/url]
How to post Performance problems by Gail Shaw[/url]
Help, my database is corrupt. Now what? by Gail Shaw[/url]