HPmal/Crusher-Y virus/spyware

Question

Hi everyone, 
 I have a problem today. the email:" 
 File "C:\Windows\System32\cmd.exe" belongs to virus/spyware 'HPmal/Crusher-Y': Process killed." is sent every time when users login the computer. 
 I need to research and find out causes and solutions for this problem. 
 I try to find the previous emails of these users which contains something like virus or spyware from flash drives, infected websites,... but I didn't see anything, just emails like that. 
 I search Google but the information I found is very common and I am not sure about them: 
 
 Downloads from questionable websites 
 Infected email attachments 
 External media, such as pen drive, DVD, and memory card already infected with HPmal/Kovter-A 
 Fake updates that trick you installing them 
 Programs posing as fake virus removal tools 
 Infected documents circulating on peer-to-peer (P2P) file sharing networks, torrent sites, and IRC channels 
 
 SO, anyone used to meet this problem, please tell me the main causes you found . 
 Many thanks, 
 Khang

QC · Accepted Answer

Hello Khang, 
 the detection is likely caused by the shell ( cmd.exe ) running an as yet unknown malicious script. The might be preceding somethings but these are not what cmd.exe runs as they would have already been blocked. As you say it's when users log in you should check what is run when they do - Sysinternal's AutoRuns should help to identify the offending file(s). Please submit a sample of you have found. 
 Christian