Jump to content

How to detect which process changes background desktop


Recommended Posts

Try something like this:

 

<?xml version="1.0" encoding="utf-8"?>
<rule>
    <definition>
        <operations>
            <operation type="WriteFile">
                <operator type="or">
                    <condition component="FileItem" property="Path" condition="starts" value="%APPDATA%\microsoft\windows\themes\cachedfiles\" />
                    <condition component="FileItem" property="FullPath" condition="is" value="%APPDATA%\microsoft\windows\themes\transcodedwallpaper" />
                </operator>
            </operation>
            <operation type="RegSetValue">
                <condition component="RegistryItem" property="Key" condition="starts" value="HKCU\software\microsoft\windows\currentversion\explorer\wallpapers\backgroundhistorypath" />
            </operation>
            <operation type="RegDeleteValue">
                <condition component="RegistryItem" property="Key" condition="starts" value="HKCU\software\microsoft\windows\currentversion\explorer\wallpapers\backgroundhistorypath" />
            </operation>
        </operations>
    </definition>
    <description>
        <name>Wallpaper was altered</name>
        <explanation>
            The wallpaper was altered
        </explanation>
        <category>
            Default
        </category>
    </description>
</rule>

 

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...