Question I woke up to find my PC open to the login section, why?

[chard77701]

So, as the title states, I saw that my laptop screen was in a different place where I had left it last. I left it on all night. I'm worried about a possible malware infection. It must have been restarted on its own while I was sleeping. I checked and it wasn't a windows update. I have a Steam program called "wallpaper engine" that is supposed to start running when I login. But upon logging in, it did not start. When I opened the program manually, there was an error message saying that the app was closed the wrong way. Is there an easy to understand log somewhere that I can read that will tell me exactly what caused my PC to reboot? I have windows 11 and avast security. I can't provide more information now because I'm at work, but if you have any ideas or can tell me a way for me to find out what happened please let me know. Thanks!

 

[SkyNetRising]

Is there an easy to understand log somewhere that I can read that will tell me exactly what caused my PC to reboot?

Did you check Event viewer?

 

[chard77701]

I just got home and I'm looking now... It simply says "The previous system shutdown at 3:32:25 AM on 2/22/2022 was unexpected." And "The system has rebooted without cleanly shutting down first. This error could have been caused if the system stopped responding, crashed or lost power unexpectedly". I'm not very familiar with events mentioned in the logs, but I browsed.
Here are some entries that I wasn't sure what they meant:
"The hypervisor did not enable mitigations for..."
"The leap second configuration has been updated. Reason: Leap second data initialized from registry during boot."
"The access history in hive... Was cleared updating 77 keys and creating 5 modified pages."
"Remote calls are being restricted using the default security descriptor..."
Then there was mention of "remote clients that call legacy password change or set RPC methods."
"The following boot-start or system-start drivers did not load: dam"
Hmm... There is a log here that says "The start type of the Wallpaper Engine Service service was changed from auto start to disabled."
Secure Trust let NULL I'd 0 and Pid 0 started with status STATUS_SUCCESS."
There was a lot of logs talking about "The start type of the Background Intelligent Transfer Service" changing back and forth.
"The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID... and APPID... to the user... From address... LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable)."
Under Application, it says:
"The Software Protection service has stopped."
Is this all normal stuff or is it pointing towards another issue?

 

[SkyNetRising]

I'd suspect wallpaper engine. It may have crashed and caused reboot.