A process monitor log might reveal what's causing the files to be downloaded: Process Monitor instructions