I imagine the files involved either are or are closely related to the “modules” called up by running processes, and are mostly dll’s. When I do an Ad-Aware scan, it starts by counting both the number of running processes and the number of active modules associated with them. On my XP-Home (with SP2) that’s typically 30 processes and around 1200 modules.