You can see the Ziova in Windows 7 logs. It looks like it is doing a logoff instead of logon:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/06/2009 23:18:45
Event ID: 4634
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: RINCEWIND
Description:
An account was logged off.
Subject:
Security ID: RINCEWIND\Guest
Account Name: Guest
Account Domain: RINCEWIND
Logon ID: 0x532d09
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Event Xml:
<Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4634</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2009-06-10T22:18:45.953887400Z" />
<EventRecordID>3204</EventRecordID>
<Correlation />
<Execution ProcessID="516" ThreadID="676" />
<Channel>Security</Channel>
<Computer>RINCEWIND</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserSid">S-1-5-21-3762704999-242599369-1225308643-501</Data>
<Data Name="TargetUserName">Guest</Data>
<Data Name="TargetDomainName">RINCEWIND</Data>
<Data Name="TargetLogonId">0x532d09</Data>
<Data Name="LogonType">3</Data>
</EventData>
</Event>