3

Data:

There are a set of Windows 10 computers. Out of 8 of those computers, three were found to have had the Windows OS altered in an unexpected way.

An advanced malware/spyware infection is suspected.

The three computers are on different networks. None of them have the ability of communicating with each other over the local network. All of them are set to automatically receive and install updates from Microsoft.

These suspected "infections" start on December 6, with the most recent being today.

The unexpected alterations were discovered after a computer which is always on with its display always on as well, was found with its display off.

It was initially believed Windows update had automatically installed the major 10.1 update, thereby causing the changes. Upon closer inspection, such an update had not been installed. Even worse, two systems which were verified to have previously been updated to 10.1 were found to have somehow downgraded themselves back to 10.0.

Most or all of the changes were reported by the event logs to have been made by 'Kernel-General' as the source.

All of the effected systems have the following similar characteristics:

1 - All of the event logs start only at the point of suspected infection for each. There is no event log data from before this point.

2 - The event logs show exact or similar logging data on all effected systems, including Event ID 26 for a one-time boot sequence (this is normally used by a legitimate Windows Update as well).

3 - Access histories were cleared in the registry.

4 - Some interactive system menus appear to be of the Windows 10.1 style (dark background, white text).

5 - New drivers and services were installed.

6 - Existing users were added to the system as if they were new.

Question:

What is happening here?

closed as off-topic by RoraΖ, Ohnana, Xander, WhiteWinterWolf, Matthew Dec 17 '15 at 12:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – RoraΖ, Ohnana, Xander, Matthew
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What's your threat model? Who might want to attack these computers, and what would their aim be? – Graham Hill Dec 16 '15 at 16:29
  • The firm who has leased these systems which we maintain and administer provides financial accounting and auditing services to a variety of international defense contractors. The firm itself has no real sensitive data, and everything is related to public sector accounts, and that data can be obtained through FOI anyways. In sum, quite boring really. – Darth Micro Dec 16 '15 at 16:58
  • I think you should probably send the information that you have for all systems to Microsoft Security. I'm not sure how we'll be able to help you as you've provided no information about what registry entries have changed, system information, types of users added, etc. Even then this really isn't the right forum for this type of issue. – RoraΖ Dec 16 '15 at 20:17
  • 1
    The log & history data vanishing is certainly cause for concern. But, FWIW, in my experience upgrading machines to Windows 10, and applying cumulative monthly Win 10 bug-fix updates and the November "Fall Update", more than a couple rather bizarre, very unexpected issues/bugs have cropped up here & there. (Although nothing directly related to logs disappearing.) So I would be a bit surprised but not shocked if the cause of what your describe turned out to be non-malicious. – mostlyinformed Dec 16 '15 at 21:43
  • 1
    Also the definitive way to tell if a PC has the Nov. update is to go to Settings-->System-->About. In the About panel you'll see that the version is 1511 and the build is 10586. The nomenclature "10.1" isn't being used by MS (for some reason). – mostlyinformed Dec 16 '15 at 22:03