How to Remove an Annoying Script Changing Your Desktop Background

Have you ever found yourself in a situation where an unexpected script is altering your desktop background? Recently, I encountered this problem when a friend created a script on my Windows 10 laptop that periodically changed my wallpaper to a rather amusing image of two monkeys. While it was funny at first, I quickly realized it was time to take action and remove this pesky script.

Understanding the Script

The script was relatively straightforward and designed to run every 10,000 seconds or upon booting up my laptop. It continuously updated my desktop background with a specific image, which I later discovered was stored in an unusual directory. This kind of script is often written using VBScript (.vbs), a simple scripting language built into Windows.

Initial Attempts to Locate the Script

In my quest to identify and eliminate the script, I began searching for a .bat file modified around the time my friend created it. Unfortunately, my search didn’t yield any results. Instead, I shifted my focus and looked for any JPG files modified on the same date, which led me to discover an image that served as the script’s base.

Taking Action

Upon further investigation, I found a critical piece of evidence—a clue that I had initially overlooked. After deleting the JPG file, I made sure to disable any related tasks in Task Manager and moved the suspicious .vbs file to my desktop for further review. Here’s a snippet of what the script contained:

“`vbscript
Dim shell : Set shell = CreateObject(“WScript.Shell”)
Dim wallpaper : wallpaper = “C:\Intel\download.jpg”
Set oSHApp = CreateObject(“Shell.Application”)

Do While True
shell.RegWrite “HKCU\Control Panel\Desktop\Wallpaper”, wallpaper
wscript.sleep 3000
shell.Run “%SYSTEMROOT%\System32\rundll32.exe user32.dll,UpdatePerUserSystemParameters”, 1, True
wscript.sleep 10000
Loop
“`

The Battle Against the Monkeys

Regrettably, my efforts were short-lived; upon restarting my laptop, the monkeys returned. I soon discovered that another copy of the script was located in a different directory, associated with an unrelated program. After deleting this instance and ensuring it was removed from both startup options and the task scheduler, I restarted my machine once again.

Conclusion

As of now, it seems like I have