I am seeing this behavior and I find it interesting.
After I close a Virtual Machine on VMWare-Workstation, even closing the VMWware-Workstation console I see lots of hard disk activiy on of the virtual machine.
I have seen this in the VMDK and in the VMEM files as you can see here.
¿Why could be this happening?
I dont think is the Antivirus software neither superfecth because I enable it only to fetch the boot files.
My trial copy of VMWare Workstation has expired so I can't check this out myself, but Process Monitor by SysInternals is your friend.
Start it monitoring the system, and then do whatever it is that you did to generate this activity. Then use process monitor to filter its results to just that file, and have a look at exactly what DLLs or processes are doing what to that file.
As a side note, process monitor is also a great way of debugging stupid cryptic error messages, such as "The file was not found". What file? Well, process monitor can tell you because it will list the exact file that the software tried to access.