cmd.exe and regedit.exe open and immediately close again

While following the above Advise with Autoruns, I would strongly suggest just to disable suspicious items, not delete them.

also if in doubt, please save the program log as autoruns.arn , rename to Autoruns.txt & attach here.

from the routine of periodically  terminating cmd & regedit , I would guess this is the action of a trojan infection or some  variant of Brontok or a similar worm, you can recover from using the below link

Microsoft Malicious Software removal tool

finally if Malwarebytes as already suggested did not do the trick, please post a hijack this log.

Thanks for the suggestions.
I've tried all the above and I can find nothing suspicious.  I have seen on other machines this before but it's always been a resident program or a changed registry.
I have replaced cmd.exe and regedit.exe directly from the CD and flagged them read only.
Also the symptoms are the same if you start in Safe Mode.

This is a brand new HP workstation about 3 months old, always lived behind the firewall and always had current Anti-Everything, but clearly it's caught something in the last few weeks.

I have attached a HijackThis log from.

I'd love to avoid rebuilding this machine for all the usual reasons.

Thanks agaion for your help.
Bruce.

Sorry I've taken so long to respond to the suggestions, but they aren't 5 minute jobs and the issues is on a busy production machine.
Does anyone have any further ideas?  
The machine scans clean with everything suggested and more, I have uploaded a Hjacthis log on the previous post.
The machine also exhibts redirect issues when you follow a link on a Google search, you often end up at an advertising site rather than the target link.
Any further suggestions would be greatly appreciated.
Thanks and regards,
Bruce.

(Hijackthis log looks to be ok)

please follow the information provided here.
http://www.updatexp.com/windows-xp-chkdsk.html

You want to run a chkdsk.
This will hopefully find and repair anything that has gone bad.

You sounds as if your system is becoming or is already Corrupted.
Hopefully the Chkdsk will help.

Good Luck
Carrzkiss

Copy teh following three lines, and paste them into a start>run>cmd window, and hit enter.

reg query "hklm\software" >c:\reg.txt
reg query "hkcu\software" >>c:\reg.txt
notepad c:\reg.txt

Paste the output of the text file here please......

Thanks for your suggestions.
I've attached the registry output johnb6767 requested.

Could also be that the Path Environment variable is not set right, if it's wrong then we can use FixPath2 to fix it.

run regedt32 and navigate to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
In the right pane check the Path if the data type is correct, it should be --> REG_EXPAND_SZ and not REG_SZ



OR: run the below batch file and post the result.
Copy and paste the bold text below into notepad.
Save this as look.bat , choose to save as *All files and place it on your desktop. Then doubleclick on the "look.bat" and show us the result.

C:\Windows\system32\reg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /s >> 
look.txt
start notepad look.txt  

downloaded to USB drive (seems to be important) ComboFix and SmitFraudFix
- restart in Safe mode with Networking
- run ComboFix from USB drive, followed instructions
- restarted in Normal mode, finished ComboFix cleanup
- restarted again in Safe mode with Networking, run SmitFraudFix, option
- http://siri.urz.free.fr/Fix/SmitfraudFix.exe
- First update it  and then searcg and remove the infections
2.Clean
- after SmitFraudFix was done, closed it and tested Run-> cmd and this time
it should work OK
- restarted in normal mode, RUn -> cmd should work as well.

Sure this would help you.

This resolved the cmd and regedit issues, and remarkably found stuff a number of other scanners didn't so it's all good.
Thanks heaps rpggamergirlpulp, this has saved me a full week in manually rebuilding the PC.