Question Why did my background and mouse cursor change overnight without anyone using my computer

[JoshQG]

Hi, I am worried because my background on my PC and my mouse cursor changed today. I last used my PC yesterday and everything was normal but when I got on today it changed. I tried to restart my PC and nothing changed back. I am just worried if I have a virus or someone has gotten onto my PC. Please help!

 

[rgd1101]

change from what to what?

 

[gn842a]

If you're connected to Windows OneDrive this is the kind of thing that might happen. Actually in my case it renamed my PC and renamed my account. And though it said I was administrator it removed my administrator powers.

So I would make a second account and give it administrator powers in case those get taken away from you.

And do everything you can to turn off Cortana and OneDrive.

I have had some periodic cursor problems since I made this build. Every now and again the cursor has turned into something that looks like a radiator of a car. Very weird. Have to reboot to make it go away.

Make system restore point. Back up your data files on an external drive.

If you feel you're losing control of your PC you may need to do a fresh OS install. In my case it wasn't a hacker. It was Windows. When you do the new install, just before it initiates, unplug from the internet. Say no to everything they throw at you about how they can make your experience "better." You will know that you have a local installation when you are asked to give the name of your dog and your mother etc as backups in case you lose your password. If you get asked for a phone number to which microsoft can text in case you can't get into your computer, you are in the belly of the beast, and they have you right where they want you. LOCAL INSTALL is better.

It is my hope that you won't need to do a fresh install.

We can't rule out a hack attack, so by all means do a Malwarebytes scan or similar. However, there are equal chances that the "hacker" is the software company that puts out the system.

And good luck.

Greg N

 

[JoshQG]

change from what to what?

It changed from a picture of the rocky mountains to just a purple background and then changed my caustic custom mouse cursor to the default one.

 

[JoshQG]

If you're connected to Windows OneDrive this is the kind of thing that might happen. Actually in my case it renamed my PC and renamed my account. And though it said I was administrator it removed my administrator powers.

So I would make a second account and give it administrator powers in case those get taken away from you.

And do everything you can to turn off Cortana and OneDrive.

I have had some periodic cursor problems since I made this build. Every now and again the cursor has turned into something that looks like a radiator of a car. Very weird. Have to reboot to make it go away.

Make system restore point. Back up your data files on an external drive.

If you feel you're losing control of your PC you may need to do a fresh OS install. In my case it wasn't a hacker. It was Windows. When you do the new install, just before it initiates, unplug from the internet. Say no to everything they throw at you about how they can make your experience "better." You will know that you have a local installation when you are asked to give the name of your dog and your mother etc as backups in case you lose your password. If you get asked for a phone number to which microsoft can text in case you can't get into your computer, you are in the belly of the beast, and they have you right where they want you. LOCAL INSTALL is better.

It is my hope that you won't need to do a fresh install.

We can't rule out a hack attack, so by all means do a Malwarebytes scan or similar. However, there are equal chances that the "hacker" is the software company that puts out the system.

And good luck.

Greg N

I am scanning with windows defender is that good enough?

 

[britechguy]

Did you just have a feature update apply? Those will occasionally revert things to what Microsoft wants them to be.

Check your recent update history.

 

[JoshQG]

Did you just have a feature update apply? Those will occasionally revert things to what Microsoft wants them to be.

Check your recent update history.

No I didn't have any feature update installed. There was also a random desktop shortcut on my downloads

 

[rgd1101]

use https://www.malwarebytes.com/
and what is this random desktop shortcut on your download?

 

[JoshQG]

use https://www.malwarebytes.com/
and what is this random desktop shortcut on your download?

It's just like desktop.ink which is just the desktop. And i'll download thanks

 

[JoshQG]

use https://www.malwarebytes.com/
and what is this random desktop shortcut on your download?

I scanned on both windows defender and malwarebytes and no threats on windows and 26 threats on malwarebytes which don't seem like they're bad. The file is pasted.

ime: 8:22 PM
Log File: 13dcbe77-b260-11e9-b9b3-4ccc6ad4dbb6.json

-Software Information-
Version: 3.8.3.2965
Components Version: 1.0.613
Update Package Version: 1.0.11776
License: Free

-System Information-
OS: Windows 10 (Build 17763.615)
CPU: x64
File System: NTFS
User: DESKTOP-39BFIAH\Josh

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 321434
Threats Detected: 26
Threats Quarantined: 26
Time Elapsed: 4 min, 50 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 24
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\REI_AxControl.DLL, Quarantined, [353], [327193],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\REI_AxControl.ReiEngine.1, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKU\S-1-5-21-3417729194-1542913697-4017479003-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{10ECCE17-29B5-4880-A8F5-EAD298611484}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\TYPELIB\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\INTERFACE\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\INTERFACE\{BD51A48E-EB5F-4454-8774-EF962DF64546}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{BD51A48E-EB5F-4454-8774-EF962DF64546}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{BD51A48E-EB5F-4454-8774-EF962DF64546}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\REI_AxControl.ReiEngine, Quarantined, [353], [327197],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\APPID\REI_AxControl.DLL, Quarantined, [353], [327193],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\REI_AxControl.DLL, Quarantined, [353], [327193],1.0.11776
PUP.Optional.Reimage, HKU\S-1-5-21-3417729194-1542913697-4017479003-1001\SOFTWARE\Reimage, Quarantined, [353], [357494],1.0.11776
PUP.Optional.Reimage, HKU\S-1-5-21-3417729194-1542913697-4017479003-1001\SOFTWARE\LOCAL APPWIZARD-GENERATED APPLICATIONS\Reimage - Windows Problem Relief., Quarantined, [353], [327203],1.0.11776
PUP.Optional.Reimage, HKU\S-1-5-21-3417729194-1542913697-4017479003-1001\SOFTWARE\REIMAGE\PC REPAIR, Quarantined, [353], [327204],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\REIMAGE\Reimage Repair, Quarantined, [353], [336077],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}, Quarantined, [353], [332494],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}, Quarantined, [353], [332494],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\APPID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}, Quarantined, [353], [332494],1.0.11776
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}, Quarantined, [353], [327206],1.0.11776

Registry Value: 1
PUP.Optional.Reimage, HKU\S-1-5-21-3417729194-1542913697-4017479003-1001\SOFTWARE\REIMAGE\PC REPAIR|QUITMESSAGE, Quarantined, [353], [327204],1.0.11776

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
PUP.Optional.Reimage, C:\WINDOWS\REIMAGE.INI, Quarantined, [353], [412667],1.0.11776

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

 

[C.wolf]

You might want to just upgrade your Windows to Version 18362 first. (1903)
Its new mouse configuration is light years ahead of the old one.

Regarding the errors,
Open a command window (run as administrator) .
At the prompt enter "sfc /scannow" without the quotes.
This will take a few minutes or more. It inspects your system files and replaces corrupt versions with clean versions,,, if it is able. Win Defender does a different job.
If it discovers unfix-able errors then use the DISM command to assist with the cleanup.
Google for details.

 

[JoshQG]

You might want to just upgrade your Windows to Version 18362 first. (1903)
Its new mouse configuration is light years ahead of the old one.

Regarding the errors,
Open a command window (run as administrator) .
At the prompt enter "sfc /scannow" without the quotes.
This will take a few minutes or more. It inspects your system files and replaces corrupt versions with clean versions,,, if it is able. Win Defender does a different job.
If it discovers unfix-able errors then use the DISM command to assist with the cleanup.
Google for details.

So you don't believe I have a virus? I am just concerned why it would change my desktop background for no reason

 

[JoshQG]

WHEN I GOT ON THIS MORNING MY BACKGROUND WAS CHANGED BACK TO PURPLE

 

[britechguy]

It sounds like you have some sort of corruption in your Windows 10 installation, which does occasionally happen.

Try Doing a Windows 10 Repair Install or Feature Update Using the Windows 10 ISO file

 

[JoshQG]

It sounds like you have some sort of corruption in your Windows 10 installation, which does occasionally happen.

Try Doing a Windows 10 Repair Install or Feature Update Using the Windows 10 ISO file

Do you think I should factory reset my PC?

 

[britechguy]

No, or I would have suggested that to begin with.

I never suggest factory resets, anyway. If one wants to start with the cleanest possible version of Windows 10, sans any OEM bloatware, then doing a completely clean install is the way to go.

I am not recommending that you do a completely clean install at this juncture. You should try the repair install first.