((Image:\\reg.exe OR OriginalFileName:reg.exe) CommandLine:add*) (CommandLine:Control\ Panel\\Desktop* OR CommandLine:CurrentVersion\\Policies\\ActiveDesktop* OR CommandLine:CurrentVersion\\Policies\\System*) ((CommandLine:\/v\ NoChangingWallpaper* CommandLine:\/d\ 1*) OR (CommandLine:\/v\ Wallpaper* CommandLine:\/t\ REG_SZ*) OR (CommandLine:\/v\ WallpaperStyle* CommandLine:\/d\ 2*))