|Run autoruns and might have to verify apps. Might have to disable stuff until you find what is causing it. Do they still happen in safe mode. |
The problem is very few apps ought to have access to that area. Be sure you run it in limited accounts.
"Best Practices", Event viewer, host file, perfmon, antivirus, anti-spyware, Live CD's, backups, are in my top 10