Two things to try come to mind:
1) About 9:05 tomorrow morning press the keychord Control-Alt-Del once to bring up the Task Manager. Open the Processes tab. Fix the size so you can see everything if at all possible. Use View, Update Speed set to High. Then, watch carefully as the time approaches 9:10. Also, alongside that windows open a Windows Explorer window to the directory where the files are being written. If you are lucky, you should see the file being written to that directory and at the same time you should see one of the processes spike briefly while that writing is taking place. If you see this then trace that process back to its owner and you'll have your culprit.
To trace back, open the Configuration utility (Start | Run | type msconfig and hit Enter). Look in the startup processes to find the name of the one you saw spike and the owner should be visible or hinted at in the path to it.
2) If that doesn't work, then you'll have to do some detective work day by day. Open the Configuration utility (see just above) and disable half the startup items and then wait until the next day or maybe set your system clock ahead to the next day and restart. If the files are not written then you know the culprit is in that half; if not it's likely in the other half. Then, half again, advance the time, restart and so forth until you narrow it down to a single item. Again, you then have your culprit.
This sort of thing is a PITA I understand (having done it myself) but it usually gives the result eventually.