How to Remove an Annoying Background Change Script from Your Windows 10 Computer

Have you ever found yourself dealing with a pesky script that changes your desktop background unexpectedly? Recently, I encountered this issue when a friend wrote a simple script on my Windows 10 laptop, causing my background to change periodically to a rather amusing image of two monkeys. If you’re in a similar situation and want to eliminate this hassle, here’s how I approached the problem.

Understanding the Script

The script was straightforward, executing a background change every 10,000 seconds or whenever I turned on my laptop. It seems to be written in Visual Basic Script (VBS), which is relatively easy to create. If you suspect a script is hiding somewhere on your system, you might want to investigate specific locations where such files could be stored.

Locating the Script

To find the troublesome script, I started by looking for .bat files that had been modified recently. Unfortunately, my search didn’t yield any results. However, while scanning through JPEG files, I discovered an image that appeared suspicious, leading me to realize it was a vital clue in this mystery.

I decided to delete the offending image, disable any startup entries in the Task Manager, and move the identified .vbs file to my desktop for further inspection. The script I found was as follows:

“`vbscript
Dim shell : Set shell = CreateObject(“WScript.Shell”)
Dim wallpaper : wallpaper = “C:\Intel\download.jpg”
Set oSHApp = CreateObject(“Shell.Application”)

Do While True
shell.RegWrite “HKCU\Control Panel\Desktop\Wallpaper”, wallpaper

wscript.sleep 3000

shell.Run "%SYSTEMROOT%\System32\rundll32.exe user32.dll,UpdatePerUserSystemParameters", 1, True

wscript.sleep 10000

Loop
“`

Taking Action

After analyzing the script, it appeared that it was configured to make repeated changes to my desktop wallpaper by modifying the registry. Believing I had removed the script, I restarted my laptop, crossing my fingers that the monkeys wouldn’t return.

The Return of the Monkeys: A Further Investigation

Unfortunately, after the reboot, I found the monkeys were back. Digging deeper, I discovered another copy of the script lurking in an unexpected directory: “C:\Python27\ArcGIS10.4\Doc\EULA.jpg” instead of the previous location I checked.

This