Windows 7 User Logon Picture Changed On Its Own

[mischik]

Hi everyone..
I'm fairly technical and was a network and tech Director for a few years so have some familiarity with prior Windows versions but Win 7 is a bit new to me. I went to login today, and my login picture had been changed. Looking in Windows Event Viewer under Security, I can see it occurred at 12:25 in the morning. I was on another computer at that time, and running a utility from Microsoft on the PC in question that just collects system information.

I was trying to figure out why it changed and reviewing the event logs. I don't see the reason, only that an account change occurred. I replicated it by changing my picture again to another one, and the same system event occurred confirming its identity.

So basically, I had a flower as the login picture. On its own, it changed to a fish. I didn't make the change. I wasn't even using this machine at that time; however a Windows utility from MS was running -- but -- I reran that same utility tonight (it's one that just reports system usage) and it did not change the picture so I believe that is coincidence.

So my question is, why would Windows 7 change the default logon picture for a user on its own to something else? To help with information the utility that MS had me run was the Microsoft Product Support Reports.

There are also multiple instances on this computer, the one where the picture changed on its own, of another PC that was running Windows 2000 logging into it as a SYSTEM, and then logging back out, then in and out continuously but not in a pattern that would make me think it was a process. My other machines on the network do not have that issue in the log file.

I checked the McAfee Firewall, and it was enabled. It has been catching attempts to login to VNC but they've been denied. VNC is also disabled.

I'm a little freaked out about what could have caused this. Any thoughts? Why would this change on its own?

Thanks,
Danielle

 

[zigzag3143]

Hi Danielle

What firewall and antivirus?

Is it a new install or upgrade?

Any shares on it?

Other users?

Are you logged on as a std user or admin?

Is UAC enabled?


Ken

 

[DocBrown]

Is it a unsecured wireless connection? Maybe somebody sees your computer online & is trying to connect to it ?

 

[mischik]

Ken thanks for your reply.
The Firewall is the latest edition of MCAfee Antivirus Plus. Same with the Antivirus.

UAC has been disabled.

The machine has been running for about a year and a half on Windows 7 Ultimate 64 with no issues until the last 5 days.. and in the last 24 hours the "fish" became the default picture for my login ID. (I have two, my user ID and Admin, both with Admin rights). There are no shares on it. No other users beyond those two.

I'm not sure why it was logging into the other PC (the Windows 2000 machine.. or if the Win2k was logging into it and there is a backdoor set up on that computer).

What is odd is that the time stamp on the change in the Security Event Manager is a time I was actually using the PC. If someone had remotely managed it or logged into it, wouldn't I have known? I was on it!

I can't figure out how Win7 would have changed the default login picture on its own. It seems it may be a hacker trying to make his or her presence known. Do I need to hire a computer forensics specialist?

DocBrown you asked about a wireless connection. Yes it was on an unsecured wireless connection. Since then I have enabled security, and have been disabling the network adapter at night when I'm not using the machine until I can figure this out. But - even if they were trying to see if they could login DocBrown, why would the picture be changed from the standard flower to the fish?

Thanks,
Danielle