Hard Drive running when not computing

I am running Windows XP and a cable modem. Sometimes I walk past the computer and the hard drive is running and will run for a long time. Is there a way I can look and see why the drive is running and what is happening?

 

try filemon.

http://technet.microsoft.com/en-ca/sysinternals/bb896642.aspx

 

Understand that Windows waits until the computer is "idle" to do many "housekeeping" tasks, updating scanners, scanning for malware, etc. The Event Manager is constantly logging events. Therefore, a computer is rarely doing nothing.

To be sure, you need to ensure you have a good firewall and real-time anti-malware solutions running. If you have decent defense, and you avoid places bad guys wallow in - such as illegal porn, gambling and sites that tolerate illegal filesharing of copyrighted songs, videos, and published documents, you should be okay. Still, it doesn't hurt to run manual scans every so often. I recommend purging the hard drives of clutter with Windows (XP or Vista) Disk Cleanup, ATF Cleaner or CCleaner. If using CCleaner, uncheck the option to install the Yahoo toolbar during installation. Before first use, go to Options > Settings > Advanced and ensure Only delete files in Windows Temp folders older than 48 hours is unchecked. Know your site credentials (user names and passwords) for sites you frequent before cleaning; you may have to login again at next visit.

Download and install Malwarebytes's Anti-Malware (MBAM) and scan as follows:

Check for updates before scanning,
Select Perform quick scan > Scan,
When complete, click OK, then Show Results,
Ensure all is selected, and click Remove Selected,
When complete, save the log in Notepad to a convenient place for future reference. ​

Repeat for all computers in the "Trusted Zone" of your network (your side of the Internet "gateway" - typically the cable or DSL modem).

Windows Disk Cleanup Note: One distinct advantage Windows Disk Cleanup has over all other cleaners is that it also has the option to delete all but the most recent Restore Point. This can be significant as malicious code can hide there too. But I caution this option, found under the More Options tab, should be used only after careful consideration. If experiencing a problem that first appeared within the last couple days, do not use this option until sure System Restore can not be used to fix it. If the computer is running fine otherwise, and you are doing your weekly supplemental scans and want to root out as many potential malware hiding places as possible, I recommend setting a new Restore Point, and then use this Disk Cleanup option to clear out the old points.

[tip] Always clean the clutter of potentially 1000s of temporary files on your drive(s) before defragging.[/tip]

Ummm, FileMon has been obsolete for about 3 years now, replaced by Process Monitor. But, IMO, the below enhanced Task Manager type programs are easier and will show you what is running on your computer. Each is nice in its own way. What's Running is probably the easiest, with AutoRuns for the more experienced, and Process Explorer the most popular. With these, for example, you can see what processes are using each of those various svchost.exe images.

AutoRuns for Windows
Process Explorer
What's Running​