Posting this in hopes it will be helpful to later users:
Yes, this activity can be caused by viruses, spyware, etc. Get a good anti-virus and clean everything up! I used Vexira. I had Backdoor.Win32.Hupigon.gpm
It puts a hidden autorun in the root of every Disk Drive, and on USB keys, which is how it travels.
You will have to enable viewing hidden files, and a couple boxes under that, uncheck "protect windows system files"
Vexira detected and cleaned all these up. Be sure you get your USB keys cleaned too!
It does leave annoying little folders called ..runauto in the root. I used the "unlocker" tool to delete these, although they are clean now. http://ccollomb.free.fr/unlocker/
Be sure that the autorun.pif file is deleted from the root of all the drives. This will cause your windows drives to not load from My Computer until after you reboot.
After all that cleaning, I still couldn't use cmd.exe, regedit.exe, etc.
I have figured out the fix for the programs that were disabled by the virus.
Backup your registry first, just in case.
It takes advantage of a debug option in the registry. I have emergency utils that gives me a copy of regedit.exe so I can edit the registry.
http://www.dougknox.com/xp/utils/xp_emerutils.htm
Look here:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
cmd.exe etc.
Under each of the .exe files that doesn't work, there is a handle called "Debugger" with the value set to "setuprs1.PIF" on mine. Delete the entire debugger entry.
If your name is the same, you can just search for all instances of setuprs1.pif, and delete them all.
This guy explains how it works. So any of those programs were actually set to install the virus again. But of course, the real program couldn't be found. And after the virus program cleaned out the .pifs, there was nothing there. It's interesting that you can actually use a completely different program so easily ... under the name cmd.exe .... NO WONDER viruses use it!
http://geekswithblogs.net/ssimakov/archive/2005/03/22/26930.aspx
Image File Execution options key as an Attack Vector on Windows
Dana Epp posted interesting article about using Image File Execution options in the Windows registry to redirecting a process loading:
By simply mapping the executable name to a different debugger source, you can actually load something else entirely.
Let me give you a proof of concept:
Start the Registry Editor: Click Start, click Run, and then type regedt32.
Locate the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
To this hive, add the SOURCE exe as a key. Lets use notepad.exe: (Right click and select New, and then Key (Add the key and name it notepad.exe)
To the notepad.exe key, add a new REG_SZ (string) value called Debugger, and point it to c:\windows\system32\cmd.exe
Start up notepad (Click Start, click Run, and then type notepad)
Notice that a new cmd window opened instead [more in Dana's blog entry]
BTW, Mark Russinovich's ProcessExplorer is using this technique to replace default Task Manager (check your HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe key)
Good luck!
