How to Remove Persistent Wallpaper Changes on Windows 10

Have you ever encountered a quirky surprise on your computer, like a background that changes to an amusing image every few seconds? While it can be entertaining at first, persistent wallpaper changes may become frustrating. Recently, a friend of mine created a simple script on my Windows 10 laptop that alters my desktop background to a picture of two monkeys at regular intervals. If you find yourself in a similar predicament, here’s how to identify and eliminate such scripts.

Understanding the Script

The script in question was written quickly, indicating that it is likely a straightforward piece of code. In this instance, the background changes every 10,000 seconds or upon restarting the laptop. While the concept may sound harmless, it’s essential to locate and remove the script to regain control of your desktop environment.

Locating the Script

Initially, I tried searching for batch files (.bat) modified recently but had no luck. However, during my investigation, I discovered an image file that had the same modification date as when the prank was set up. Realizing this, I used my instincts to delete the suspicious image and check the Task Manager to disable any related startup entries.

Dissecting the Code

Upon further exploration, I found the following Visual Basic Script (VBS):

“`vbscript
Dim shell : Set shell = CreateObject(“WScript.Shell”)
Dim wallpaper : wallpaper = “C:\Intel\download.jpg”
Set oSHApp = CreateObject(“Shell.Application”)

Do While True
shell.RegWrite “HKCU\Control Panel\Desktop\Wallpaper”, wallpaper
wscript.sleep 3000
shell.Run “%SYSTEMROOT%\System32\rundll32.exe user32.dll,UpdatePerUserSystemParameters”, 1, True
wscript.sleep 10000
Loop
“`

This script continuously resets the wallpaper every few seconds. It’s a simple loop that modifies the registry to change the wallpaper and executes a system command to refresh it.

Taking Action

After copying the script for reference, I restarted my laptop, hopeful for a fresh start. To my dismay, the monkey wallpaper reappeared. Upon further inspection, I found a duplicate script hidden under a different file path unrelated to the original location.

Key Findings:
– Multiple Copies: The script had a presence both in the startup section and the task scheduler, which were both contributing to the issue.
– **Check File Paths