Hi, you can find the sysinternals filemon output below; this hdd event occurs every minute with high disk activity. its recorded while there were no other programs running, indexing, shadow copy and system restore sevices were disabled. I have checked another computer with sp2 and this acitivity wasn't that often. this is happening on a clean fresh setup not connected to internet and virus free. what may cause explorer to do such heavy activity regardless of system being busy or idle. I'll appreciate any ideas, thanks 17:16:07 explorer.exe:1840 IRP_MJ_CREATE C:\ SUCCESS Options: Open Directory Access: All 17:16:07 explorer.exe:1840 IRP_MJ_QUERY_VOLUME_INFORMATION C:\ SUCCESS FileFsFullSizeInformation 17:16:07 explorer.exe:1840 IRP_MJ_CLEANUP C:\ SUCCESS 17:16:07 explorer.exe:1840 IRP_MJ_CLOSE C:\ SUCCESS 17:16:07 explorer.exe:1840 IRP_MJ_CREATE D:\ SUCCESS Options: Open Directory Access: All 17:16:07 explorer.exe:1840 IRP_MJ_QUERY_VOLUME_INFORMATION D:\ SUCCESS FileFsFullSizeInformation 17:16:07 explorer.exe:1840 IRP_MJ_CLEANUP D:\ SUCCESS 17:16:07 explorer.exe:1840 IRP_MJ_CLOSE D:\ SUCCESS