C:\WINDOWS\system32\cmmon.exe

用unlocker删掉或者在安全模式下删掉应该就可以了
记得把注册表里的也删掉

It took me several days to figure it out.
My case is IE started automaticlly about 10 minutes with the website like: wiki.cn...
It seems lots of people have the similar problem here. Hopefully it can be helpful.

In my case:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
delete "C:\WINDOWS\system32\cmmon.exe", just keep "C:\WINDOWS\system32\userinit.exe"