How to Identify and Remove a Persistent Wallpaper Script on Windows 10

If you’ve ever found yourself with a bizarre wallpaper that changes to an image of two monkeys every so often, you might be dealing with a simple script written to change your desktop background without your consent. This guide outlines how to identify and remove such a script from your Windows 10 computer, ensuring your desktop is restored to normalcy.

What’s Going on with Your Computer?

Recently, a friend of mine had a little fun and created a script on my laptop. This script automatically changes my desktop wallpaper to a specific image—one of two monkeys—every 10,000 seconds, or every time I power on my device. It’s a relatively straightforward script, suggesting it wouldn’t take much to track down.

If you find yourself in a similar situation, it’s essential to know what type of script you may be dealing with and how to locate and eliminate it effectively.

Searching for the Culprit

Initially, I began my search by looking for any batch files (.bat) modified around the time my friend wrote the script. When that didn’t yield any results, I expanded my search to JPEG files, only to discover something peculiar. After taking a closer look, I found an image file that rang a bell and noted its path could have hinted at something being amiss.

To tackle the problem:

1. Check for Known File Types: Look for common file types associated with scripts such as .vbs or .bat. Using file explorer to sort by date modified can help locate recently added files.

2. Consider Task Manager and Startup Items: Sometimes, scripts run at startup. You can check the Task Manager (Ctrl + Shift + Esc) under the ‘Startup’ tab to disable any suspicious entries.

3. Inspect Scheduled Tasks: Some scripts may be set to run at specific intervals via the Task Scheduler. A quick glance here can uncover any hidden scripts.

Take Action

After some digging, I identified a .vbs file associated with the wallpaper change. This prompted me to clean up:

• I deleted the monkey image from my computer.
• I disabled an entry in the Task Manager’s startup section.
• I moved the .vbs file to my desktop for reference.

Upon restarting my laptop, however, the monkeys returned! This indicated there was likely another copy lurking somewhere.

Further Investigation

Continuing my search, I discovered an unexpected copy of the wallpaper script