How to Remove an Annoying Background Changing Script from Your Windows 10 Computer

Have you ever faced the annoyance of your computer background changing unexpectedly? Recently, a friend of mine decided to play a prank by writing a script on my Windows 10 laptop that periodically changed my wallpaper to a rather amusing image of two monkeys. While it was a funny gesture at first, it quickly became tiresome, and I knew I had to remove it.

Identifying the Script

The script was designed to execute every 10,000 seconds (approximately every 2 hours, 46 minutes) or each time I turned on my laptop. It leveraged a Windows Script Host (WSH) to change the background. Knowing that it was a simple script that my friend whipped up in just a few minutes, I set out to locate and eliminate it.

Initially, I searched for any batch files that might have been created recently, but my efforts yielded no results. Then, I turned my attention to associated image files and found one that should have been my first clue—it was oddly named.

Resolving the Problem

Upon further investigation, I managed to identify the troublesome script in my system. Below is a simplified version of it:

“`vb
Dim shell : Set shell = CreateObject(“WScript.Shell”)
Dim wallpaper : wallpaper = “C:\Intel\download.jpg”
Set oSHApp = CreateObject(“Shell.Application”)

Do While True
shell.RegWrite “HKCU\Control Panel\Desktop\Wallpaper”, wallpaper
wscript.sleep 3000
shell.Run “%SYSTEMROOT%\System32\rundll32.exe user32.dll,UpdatePerUserSystemParameters”, 1, True
wscript.sleep 10000
Loop
“`

After discovering the script, I took several decisive actions. Here’s what I did:

1. Deleted the Image File: I removed the image file that the script referenced.
2. Disabled Startup Items: I accessed the Task Manager and disabled any entries related to the script in the startup tab.
3. Moved the Script: I transferred the .vbs file to my desktop temporarily for further examination.

The Comeback of the Monkeys

Unfortunately, after restarting my laptop, the monkeys returned! This led me to dig a bit deeper. It turned out that there was another copy of the script lurking in a directory linked to Python. Once I identified and deleted that version, along