He wrote the script in a couple minutes so it’s definitely nothing complicated. Every 10,000 seconds or whenever I turn on my laptop it changes the background to this picture.
Any guesses to what type of script this is or where it might be hiding, and if there’s anything else I need to do to remove it? I have a Windows 10 computer.
Update: Tried searching for a .bat file with date modified yesterday with no luck. Then looked for a jpg with that date modified and found this. I realize now that this should have been a tipoff. I deleted the picture, disabled the startup in task manager, and moved the .vbs to my desktop to post it here. That script is below. I’m going to restart my laptop and see what happens. I think it’s possible there’s something else too.
Update 2: Monkeys are back. Found another copy under “C:\Python27\ArcGIS10.4\Doc\EULA.jpg” instead of “\Intel\download.jpg”. Restarted after deleting and we’re good so far. One was in startup and the other in task scheduler. Unless there’s something else in that script you guys see, it looks like that’s all folks.
Dim shell : Set shell = CreateObject("WScript.Shell")
Dim wallpaper : wallpaper = "C:\Intel\download.jpg"
Set oSHApp = CreateObject("Shell.Application")
Do While True
shell.RegWrite "HKCU\Control Panel\Desktop\Wallpaper", wallpaper
wscript.sleep 3000
shell.Run "%SYSTEMROOT%\System32\rundll32.exe user32.dll,UpdatePerUserSystemParameters", 1, True
wscript.sleep 10000
Loop
