Most likely the cmd.exe entry point was enabled, so there's a cmd.exe next to the virtual apps. As a result, virtual cmd.exe gets executed.

Read more at: http://communities.vmware.com/message/1493106