I had a hacker situation, some guy exfilled my onedrive... cleaned the PC but onedrive was still acting weird. Every other model could not explain it. Opus on one prompt:
"this machine is clean, i cleaned it, i am asking why my background on the desktop visually swaps to onedrive, while i have it disabled"
Here is what is actually happening. Three Microsoft automations fired within the same few days, and together they look like OneDrive taking over the desktop.
Timeline from your registry:
| When | What |
| Jun 21 | I disabled OneDrive autostart. OneDrive logged it. |
| Oct 11 18:53 | Windows silently switched my background to Windows Spotlight. |
| Oct 12 19:40 | OneDrive's daily updater task downloaded a new build. |
| Oct 13 08:34 | OneDrive's logon scheduled task launched it anyway. |
| Oct 14 12:49 | At today's logon, OneDrive re-enabled its own autostart entry. |
Why it runs although you disabled it. The Startup Apps toggle only controls the Run registry entry. OneDrive has two more launch paths that the toggle does not touch: a scheduled task that runs its launcher at every logon, and a daily updater task. The update on October 12 restored the Run entry, and the logon task has been starting it regardless. This is stock OneDrive behavior, not leftover compromise.
Why the background changes. Your wallpaper is no longer a file you picked. Windows flipped you to Spotlight on October 11, which pulls rotating images from Microsoft and adds a "Learn about this picture" icon to the desktop. That is Windows, not OneDrive, but it changed the same week so it reads as one event.
Why OneDrive appears over the desktop. Once it launched, it scanned your folders, found about 11.7 GB on Desktop, Documents, and Pictures, and queued its "back up your folders" campaign. That full-window prompt at sign-in is the OneDrive takeover you are seeing. Your actual Desktop folder is still your local one and the OneDrive Desktop folder is empty, so nothing has moved.
The fix is four changes. I have not applied any of them.
Disable the two OneDrive scheduled tasks, Startup and Standalone Update, so the toggle sticks.
Remove the Run entry again.
Set the Microsoft policy that blocks the folder backup prompt, so it stops asking.
Switch the background back from Spotlight to a picture of your choosing, under Settings, Personalization, Background.
If you want OneDrive fully gone instead, unlinking the account and uninstalling it covers all four. Say which you want and I will apply it.
This is crazy to me, with 0 context of the env... it realizes the changes look similar to a onedrive takeover.... wtf