Downloaded application displays a screen before Windows starts

Just had a call from my brother who lives 150 miles from me with a Windows problem I don't quite know how it manifests itself.

He has downloaded what it seems to be an Excel tutorial which causes a schedule screen to appear after the pc has powered on and the POST BUT before Windows has loaded or he has even logged in.

Is there a way to search for the rogue file that is loading before Windows starts?
He does have Malwarebytes and Norton as anti-malware and anti-virus respectively.

Now that I have spoken with my brother in length to what the issue is I am better positioed to explain with the aid of screenshots what is actually happening.
When he powers on the pc and the BIOS goes through its Post he gets the "Choose an operating system" screen as shown in Fig1.

Fig.1
After the 10 seconds is when the start screen such as Fig.2 has been replaced by Fig.3

Fig.2 no longer shows

instead Fig.3 shows!!

So, what we need is help to find where the file for Fig.3 is (may be in System Configuration or the registry I don't know) and be able to replace it with Fig.2, although Windows does change the image now and then, so that everything is back to normal.
The issue does not seem to have any other effect other than being a nuisance.

Any help would be most appreciated.

Hi @Ztruker,
Here is the screenshot you requested.


Having searched for the offending image I found that it is in Settings > Personalisation > Lock screen
It is now a question of trying to delete it but I can't find a way of removing/deleting the offending image.
Is there way to do just that, delete/remove the image?

Thanks. I will try the tutorial above and possibly this tutorial to find where the offending image is stored. It may be that it is stored in the Pictures folder??

Things we have done to find the offending .gif image; Not in C:\Windows\Web\Screen or any of the folders within.
Followed steps 1 to 4 and 6 of the Change Lock Screen Background in Windows 10 tutorial, clicked Browse which takes us to the pictures folder but the image is not there also inspected the Video folder but again it was not there.
Tried the Assets folder but there are no images for the date in which the issue started.
Searched for the file name in Cortana and found that there was a file named Insert-check-mark-with-a-double-click[1].gif which is the offending image file name in D:\username\Temporary. Deleted the file thinking that, that would solve the issue but I regret to say it has not, the image remains in Setting > Personalisation > Lock screen, so the search to delete the file continues. The only other place that needs to be inspected I suppose is the Registry but don't know which key to look for!
The author of the web link/file must have written a code/batch file/patch for the file to be embedded within Windows.