In my windows XP installation, the system harddrive constantly (every 3 sec about) writes to the drive. This ofcourse makes alot of unessessary noise.

Nothing special is running according to the taskmanager (system waitprocess is using 99% cpu).

When I check what is accessing the harddrive at these intervals (using sysinternals FileMON)...it is the files NTUSER.DAT and NTUSER.DAT.LOG that is cousing these constant harddrive-writing.

Why is it doing this, and how do I fix it? Extremly annoying.

Have you defragged recently?

The installation is very new...and there drive is not used for anything but the system.

It is not fragmented.

I've found a clean install and then loading software does fragment the drive a lot. Defrag is a simple quick step to take before looking deeper. I defrag at least once a week. If I've done complex stuff like video or photo editing I run after I finish.

Joe

Drive is now defragged. Fragmentation at 0%.

No change at all, system is still constantly accessing NTUSER.DAT.

Is the drive new or old? If old and making noise, depending on type of noise, your HDD may be failing.

It is brand new (Seagate Cheetah 15k.5).

The problem is the drive is accessed constantly by the system...even when totally idle.

This was not the case when I just installed windows.

I really don't want to reinstall windows again to get rid of this.

NTUSER.DAT is a part of the registry. Probably some software is constantly updating some register key, causing the System to write it to file. You can use RegMon to find out which program.

indexing service will do that too...see if your have that in the services...usually it will continue until it done..sometimes it takes a while..then settles down once in makes a complete index...you can set it to 'disable' or 'manual' in the services

Indexing service is not running

These are the ones that is mostly active according to RegMon (gets on list when drive makes sound):

C:\WINDOWS\system32\services.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

nvsvc32.exe is the Nvidia driver helper service, and I think this is your culprit - and here's why:

- services.exe will be listed any time a service is accessed (nvsvc32.exe is a service)

- svchost.exe will be accessed any time the nvsvc32.exe is accessed - not sure why, but I've found a few posts on the net stating that the nvsvc32.exe binary uses something in a shared svchost (probably RPC or COM)

- lsass.exe is invoked when a read or write to a user's registry is done by a service (nvsvc32.exe is a service)

Try setting the Nvidia Display Driver Service to manual or disabled and stop the service (from services.msc), and see if the problem goes away (it seems likely that it will)

Did it.

No change.

Especially

120.04818726 lsass.exe:960 OpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Access: 0x20019

120.04819489 lsass.exe:960 QueryValue HKLM\SECURITY\Policy\SecDesc\(Default) BUFFER OVERFLOW

120.04820251 lsass.exe:960 CloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS

Pops up all the time

Network virus?

I uninstalled .Net Framework 1.1

Much better now.

Crappy network system.

120.04818726 lsass.exe:960 OpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Access: 0x20019

120.04819489 lsass.exe:960 QueryValue HKLM\SECURITY\Policy\SecDesc\(Default) BUFFER OVERFLOW

120.04820251 lsass.exe:960 CloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS

That's really, really odd.

Wonder why .net would be trying to look up a SecDesc ACL on something... Have I mentioned that is odd?