There are a set of Windows 10 computers. Out of 8 of those computers, three were found to have had the Windows OS altered in an unexpected way.
An advanced malware/spyware infection is suspected.
The three computers are on different networks. None of them have the ability of communicating with each other over the local network. All of them are set to automatically receive and install updates from Microsoft.
These suspected "infections" start on December 6, with the most recent being today.
The unexpected alterations were discovered after a computer which is always on with its display always on as well, was found with its display off.
It was initially believed Windows update had automatically installed the major 10.1 update, thereby causing the changes. Upon closer inspection, such an update had not been installed. Even worse, two systems which were verified to have previously been updated to 10.1 were found to have somehow downgraded themselves back to 10.0.
Most or all of the changes were reported by the event logs to have been made by 'Kernel-General' as the source.
All of the effected systems have the following similar characteristics:
1 - All of the event logs start only at the point of suspected infection for each. There is no event log data from before this point.
2 - The event logs show exact or similar logging data on all effected systems, including Event ID 26 for a one-time boot sequence (this is normally used by a legitimate Windows Update as well).
3 - Access histories were cleared in the registry.
4 - Some interactive system menus appear to be of the Windows 10.1 style (dark background, white text).
5 - New drivers and services were installed.
6 - Existing users were added to the system as if they were new.
What is happening here?