Mike Hodnick

Someone in the Inetium office is messing with me. One day last week, and again yesterday, my Windows desktop wallpaper was automatically changed to this image:

I went to my Desktop properties to change it back to something else, but my wallpaper controls were disabled. What's also weird is that the image is "doctored". Most of the image is real - that is really me behind a goalie prop at the XCel Energy Center - but that flaming flag thing is not a part of the original image. Thus my research began...

• In the registry, my desktop wallpaper was pointing to an image named "hods.jpg" out on a share of our domain controller.
• I changed the registry value, but when I rebooted the setting was overwritten.
• Very few people in the office call me "hods". I have a lousy poker face, but did the best I could yesterday to try and snuff out the person that did this. Nobody fessed up.
• I talked to a couple of our domain admins and they couldn't figure out how the setting was being written, nor could they identify the the individual who put the image out on the share. The owner was only shown as "Administrator".
• I checked out the other profile folders under my Documents and Settings folder, and there was only one other one besides myself. That folder is the name of one of our old domain admins and it was created back in January 2005. I didn't see any evidence in there that he had logged in recently.
• I verified in my startup settings (using msconfig) that no special batch file or script is being run on startup.
• In the meantime I've eliminated all shared folders and have removed all known "extra" permissions to folders on my machine.
• I now have successful security events logged to my security log, so I can now find out if someone else is logging in to my machine.

Late yesterday after rebooting another time, my wallpaper settings were unlocked and I could change the wallpaper. I was never able to track down the perpetrator.

What's a bit annoying about all this is that I do demos and use my laptop with client users pretty often, so to unexpectedly see that image stretched across my screen when I log in at a client is a little awkward. But overall, I'd rather find out who is doing it than solve the problem. I guess I'll just see if the problem happens again.