How to Remove a Sneaky Background-Changing Script from Your Windows 10 Computer

Have you ever found your computer behaving unexpectedly? If so, it might be because of a hidden script that someone else created on your machine. Recently, a friend of mine wrote a simple script on my laptop that periodically changes the desktop background to an amusing image of two monkeys. While it elicited a good laugh at first, I soon realized I needed to get rid of it.

Understanding the Script

My friend whipped up the script in mere minutes, so it’s not complex. It triggers a change to the desktop wallpaper every 10,000 seconds (about 2 hours and 45 minutes) or whenever I turn on my laptop. The chosen image? An endearing photo of two monkeys.

Curious about the nature of this annoyance, I dove right into the search for the script’s location. Being equipped with a Windows 10 computer, I started scanning for any .bat files modified yesterday, but my efforts didn’t yield any results. Instead, I switched gears and sought .jpg files modified around the same time. My search led to discovering a particular image linked to the mischievous script.

Uncovering Clues

Upon further investigation, I stumbled upon a curious file with an odd name, which should have been my first clue that something was amiss. After realizing what I was dealing with, I promptly deleted the problematic image, disabled any associated startup tasks in the Task Manager, and relocated the dangling .vbs script to my desktop for further examination.

Here’s the script in question:

“`vbscript
Dim shell : Set shell = CreateObject(“WScript.Shell”)
Dim wallpaper : wallpaper = “C:\Intel\download.jpg”
Set oSHApp = CreateObject(“Shell.Application”)

Do While True
shell.RegWrite “HKCU\Control Panel\Desktop\Wallpaper”, wallpaper

wscript.sleep 3000

shell.Run "%SYSTEMROOT%\System32\rundll32.exe user32.dll,UpdatePerUserSystemParameters", 1, True

wscript.sleep 10000

Loop
“`

After this cleanup effort, I decided to restart my laptop to see if the pesky monkeys would make a comeback.

The Monkeys Return

Unfortunately, after rebooting, I noticed the monkeys were back in business. Delving further into my file system, I uncovered another instance of the script hidden under a different