Troubleshooting a Persistent Background Change on Windows 10

Have you ever found yourself dealing with a tech prank gone awry? A friend of mine recently wrote a simple script on my Windows 10 laptop that changes my desktop background to an image of two monkeys periodically—specifically, every 10,000 seconds or upon startup. While it was all in good fun, I find myself wanting to regain control over my desktop!

Understanding the Script

The script in question is relatively simple and likely not stored in an obvious location. Initially, I attempted to locate a batch file that might have been created, but to no avail. My next step was to search for any JPEGs modified around the same time as the script’s creation and I stumbled upon an oddly named image file that wasn’t immediately suspect.

Upon further reflection, I noticed a less-than-subtle clue in the file’s name that should have raised my suspicions sooner! I eventually deleted the image, disabled the startup entry in Task Manager, and relocated the script to my desktop for safe keeping. Here’s a look at the script:

“`vbscript
Dim shell : Set shell = CreateObject(“WScript.Shell”)
Dim wallpaper : wallpaper = “C:\Intel\download.jpg”
Set oSHApp = CreateObject(“Shell.Application”)

Do While True
shell.RegWrite “HKCU\Control Panel\Desktop\Wallpaper”, wallpaper
wscript.sleep 3000
shell.Run “%SYSTEMROOT%\System32\rundll32.exe user32.dll,UpdatePerUserSystemParameters”, 1, True
wscript.sleep 10000
Loop
“`

Attempting a Fix

After restarting my laptop to check if these actions worked, the monkeys made an unwelcome return. A deeper investigation led me to another copy of the script saved under an unexpected file path: C:\Python27\ArcGIS10.4\Doc\EULA.jpg, instead of the earlier location.

After addressing the second script, I ensured I thoroughly checked both the startup programs and Task Scheduler. Thankfully, removing them both seemed effective, and I’ve been monkey-free ever since!

Conclusion: Keep an Eye on Your System

If you ever encounter a similar situation, I recommend inspecting both your startup settings and Task Scheduler for any unfamiliar entries. Thoroughly check your system for any remaining scripts that might not be immediately