How to Remove a Tricky Background Changing Script on Windows 10

If you’ve ever found yourself with an unwanted background on your computer, particularly one that’s been stealthily installed by a friend, you’re not alone. Recently, I encountered a peculiar situation involving a script that changes my desktop wallpaper to an image of two playful monkeys every 10,000 seconds or each time I reboot my machine. Here’s a detailed account of my experience and the steps I took to resolve the issue.

The Background of the Problem

The script, crafted by a friend in just a matter of minutes, seemed quite rudimentary. I knew I needed to track it down and eliminate it. The first step was to search for any .bat files or suspicious images that might have been created around the same time the script was initially run. Unfortunately, my initial searches didn’t yield any results, leaving me puzzled.

The Discovery Process

After sifting through various files, I finally stumbled upon an image that had been modified on the same date – a file that linked back to that pesky wallpaper incident. Upon deeper inspection, I uncovered another clue: the file path pointed to a place that should have indicated a red flag.

After deleting the suspicious picture and disabling its entry in Task Manager, I decided to isolate the script itself on my desktop for closer scrutiny. The code looked straightforward yet effective, as it continually overwrote the registry with a specified wallpaper filepath, which was clearly part of the problem.

Here’s the script for reference:

“`vbscript
Dim shell : Set shell = CreateObject(“WScript.Shell”)
Dim wallpaper : wallpaper = “C:\Intel\download.jpg”
Set oSHApp = CreateObject(“Shell.Application”)

Do While True
shell.RegWrite “HKCU\Control Panel\Desktop\Wallpaper”, wallpaper
wscript.sleep 3000
shell.Run “%SYSTEMROOT%\System32\rundll32.exe user32.dll,UpdatePerUserSystemParameters”, 1, True
wscript.sleep 10000
Loop
“`

The Final Steps & Reoccurrence

After relocating the script, I rebooted my laptop, hoping that my solution had worked, only to find the monkeys had returned in full force. Further investigation revealed another rogue copy of the original wallpaper file hidden in an unrelated directory.

This time, I made sure to remove both instances of the script and one from the Task Scheduler. Having done this, I restarted my system