It's not really a big deal, but it caused a ruckus in the office AMONG the some of the people here who thought we'd been hacked and the sky was falling.

On one computer on our network, the USER changed her DESKTOP image (via Internet Explorer's Use as Desktop when she right-clicked the image) on Friday night. When the staff came in early Monday morning, that same desktop image appeared on a different machine, which happens to be a Citrix server. Both computers are Windows NT 4.0 as far as I know. (I know the user's machine is, and I'm told the Citrix server is as well.)

I don't have direct access to the Citrix server to investigate (had to walk them through the process of changing the desktop image because they were convinced it was evil somehow) further, but can anyone tell me how a local desktop preference like that migrated to another machine? They seem to be convinced that the Citrix server wasn't restarted between the time that the desktop images changed, but I can't confirm or deny that.

As a side note, I had to spend twenty minutes explaining that we did not need a "FIREWALL or something" between our machines **inside the network** to keep the scourge of migrating desktop backgrounds from murdering us all in our beds as we sleep.

Apparently, before I got here this morning, they were convinced the whole network was infected with teh haxx0r and freaking out at the idea of having to wipe the machines and reload them.

If I could explain how it happened, I think it would calm things down here. Are those the only changes you saw made on the server? The network is behind a firewall, correct?

[glb]Gizmo73[/glb]Control panel admin tools........click the events view logs...what does it tell you?Hi there. Thanks for the responses.

I am in a different area of the company from the Citrix server, but as there is still some ?!?!? over the desktop image changing, I am going to head over tomorrow and deal with it in person.

We are behind a firewall, and the Citrix server is in all other ways functioning normally. (This much I can see from my end.)

I will look at the event log. That should be enlightening. Thank you for reminding me of it. I'll post more after I'm able to actually sit in front of that keyboard tomorrow and let you guys know what the resolution is.I bet this will be an interesting reply .......oops i have just seen someone go flying pass the window....... I am sure Nostradamus predicted this.

Where did she obtain the background?

Did the user who changed the background log in on the other machines with her account?Kathy:

If you believe your LAN's antivirus programs have been compromised, you may try some free, online virus scans on the machine believed to be infected:

http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=GGLD,GGLD:2004-51,GGLD:en&q=free+online+virus+scans

Regards,
DocHere's the resolution:

I went to the computer where the problem originated from. I asked her to show me what she did to change the desktop image.

At this point, she said it was odd, because "it made her do it twice before it was changed".

She then changed the image on her desktop, logged into a terminal server, said, "See?", then changed the desktop image on the terminal server.

I don't know why I didn't think of this. This is the most obvious way to see a change on the terminal server. I'm still beating my head against the wall.

In my defense, I didn't know and hadn't been told up to that point that she was logging into the terminal server, and I when they showed me the OFFENDING desktop image before, it was on her regular desktop. Urk.

I feel like such a noob.

Thanks for the help, guys.