explorer based hdd activity

[blasto]

Hi,

you can find the sysinternals filemon output below; this hdd event occurs every minute with high disk activity. its recorded while there were no other programs running, indexing, shadow copy and system restore sevices were disabled. I have checked another computer with sp2 and this acitivity wasn't that often. this is happening on a clean fresh setup not connected to internet and virus free. what may cause explorer to do such heavy activity regardless of system being busy or idle. I'll appreciate any ideas, thanks

17:16:07 explorer.exe:1840 IRP_MJ_CREATE C:\ SUCCESS Options: Open Directory Access: All

17:16:07 explorer.exe:1840 IRP_MJ_QUERY_VOLUME_INFORMATION C:\ SUCCESS FileFsFullSizeInformation

17:16:07 explorer.exe:1840 IRP_MJ_CLEANUP C:\ SUCCESS

17:16:07 explorer.exe:1840 IRP_MJ_CLOSE C:\ SUCCESS

17:16:07 explorer.exe:1840 IRP_MJ_CREATE D:\ SUCCESS Options: Open Directory Access: All

17:16:07 explorer.exe:1840 IRP_MJ_QUERY_VOLUME_INFORMATION D:\ SUCCESS FileFsFullSizeInformation

17:16:07 explorer.exe:1840 IRP_MJ_CLEANUP D:\ SUCCESS

17:16:07 explorer.exe:1840 IRP_MJ_CLOSE D:\ SUCCESS

[cluberti]

Do you have antivirus software or antispyware software involved, or even backup software? Any piece of software that uses a filter driver is suspect.

[blasto]

I'm using Avg antivirus free ed. but as I said I'm ending all non-system processes before testing, anyway the explorer keeps up spinning the hdd. Filemon doesn't show any application other than explorer, how can I track such an embedded driver or else?

[cluberti]

Process explorer can show you what's actually running in the explorer.exe process.