Windows 7 Windows 7 Logon Picture Changed On Its Own

[mischik]

Hi everyone..
I'm fairly technical and was a network and tech Director for a few years so have some familiarity with prior Windows versions but Win 7 is a bit new to me. I went to login today, and my login picture had been changed. Looking in Windows Event Viewer under Security, I can see it occurred at 12:25 in the morning. I was on another computer at that time, and running a utility from Microsoft on the PC in question that just collects system information.

I was trying to figure out why it changed and reviewing the event logs. I don't see the reason, only that an account change occurred. I replicated it by changing my picture again to another one, and the same system event occurred confirming its identity.

So basically, I had a flower as the login picture. On its own, it changed to a fish. I didn't make the change. I wasn't even using this machine at that time; however a Windows utility from MS was running -- but -- I reran that same utility tonight (it's one that just reports system usage) and it did not change the picture so I believe that is coincidence.

So my question is, why would Windows 7 change the default logon picture for a user on its own to something else? To help with information the utility that MS had me run was the Microsoft Product Support Reports.

There are also multiple instances on this computer, the one where the picture changed on its own, of another PC that was running Windows 2000 logging into it as a SYSTEM, and then logging back out, then in and out continuously but not in a pattern that would make me think it was a process. My other machines on the network do not have that issue in the log file.

I checked the McAfee Firewall, and it was enabled. It has been catching attempts to login to VNC but they've been denied. VNC is also disabled.

I'm a little freaked out about what could have caused this. Any thoughts? Why would this change on its own?

Thanks,
Danielle

 

[ChatGPT]

Danielle, it sounds like you've encountered quite an unusual situation with your Windows 7 machine. The unexpected change in the default login picture and the peculiar activity in the event logs can indeed be unsettling. Let's try to dissect the different aspects of your issue and see if we can shed some light on what might have happened:

1. Automatic Change of Login Picture:
   • Microsoft Product Support Reports Utility: While it seems unlikely that the Microsoft Product Support Reports utility directly caused the change in the login picture, its coincidence with the event could be a red herring. This utility is primarily designed to collect system information for support purposes and isn't known to interfere with user settings like login pictures.
   • Windows System Anomaly: Windows 7 changing the default login picture on its own without user intervention is not a common occurrence. This behavior could be due to a glitch, a rare system bug, or potentially some external factor causing this change.
   []Strange System Activity:
   • Windows 2000 Login Events: The repetitive login and logout events from a system running Windows 2000 into your Windows 7 machine as SYSTEM is quite unusual and may indicate some form of unauthorized access or system misconfiguration.
   • McAfee Firewall: It's positive that your McAfee Firewall has been blocking unauthorized attempts to login to VNC. This suggests that the firewall is functioning as intended and safeguarding your system against potential threats.
   []Potential Explanations:
   • Malware: While it's important to consider benign explanations first, the unusual system behavior could be indicative of malware activity. Malicious software may attempt to make subtle changes to user settings like the login picture.
   • Corrupted System Files: In rare cases, corrupted system files or registry entries could lead to unexpected changes in user settings.
   • Unauthorized Access: The events involving Windows 2000 logging in as SYSTEM might point towards unauthorized access attempts, which could be a security concern. To address your concerns and investigate further, here are some steps you could consider taking:
     • Perform a thorough scan of your system using reliable antivirus software to rule out the presence of malware.
     • Review system logs beyond the Security event log to identify any additional clues about the login picture change.
     • Consider restoring your system to a previous state using System Restore if the issue persists and appears to be software-related.
     • Monitor your system closely for any further unusual activities and consider implementing additional security measures to safeguard your system.
     If you require further assistance or encounter more anomalies, feel free to provide additional details or reach out for further guidance. Stay vigilant and proactive in protecting your system's security.