Removing an Unexpected Background Script from Your Windows 10 Computer

It can be quite surprising when you discover that your computer’s settings have been altered without your consent. A recent experience shared by a friend revealed a playful yet frustrating script that automatically changes the desktop background to a humorous image of two monkeys at regular intervals. If you’re facing a similar situation, this guide will help you understand such a script and how to remove it effectively.

Understanding the Script

The script in question was likely created in just a few minutes, indicating that it is fairly straightforward. It changes the desktop wallpaper every 10,000 seconds or whenever the laptop is powered on. In this case, the image was a cheeky picture of two monkeys, prompting the need for immediate action to remove the unwanted behavior from the system.

Steps to Locate and Remove the Script

1. Search for the Script File: Begin by searching your computer for any batch files or scripts that may have been created by your friend. In Windows 10, you can look for files with a recent modification date. Unfortunately, the initial search didn’t yield successful results, so it’s essential to broaden your scope.

2. Identifying the Image: Often, the script may reference a specific image file that also needs to be addressed. Locating an image file with a suspicious modification date could lead you closer to finding the script or the source.

3. Review Startup Programs: Access the Task Manager and check the ‘Startup’ tab to see if the script is set to run upon startup. Disabling unnecessary startup items can prevent the script from executing again.

4. Examine Task Scheduler: Sometimes, such scripts might be scheduled through the Windows Task Scheduler. Check for any tasks that seem out of place and remove them if necessary.

Discoveries and Actions Taken

After further investigation, it was discovered that the script was hidden not only in the expected paths but also under unexpected ones, like C:\Python27\ArcGIS10.4\Doc\EULA.jpg. Both the original script and the monkey image were located and deleted.

The revealed script snippet looked something like this:

“`vbscript
Dim shell : Set shell = CreateObject(“WScript.Shell”)
Dim wallpaper : wallpaper = “C:\Intel\download.jpg”
Set oSHApp = CreateObject(“Shell.Application”)

Do While True
shell.RegWrite “HKCU\Control Panel\Desktop\Wallpaper”, wallpaper
w