When I close my PC a macro is executed. How can I locate the infringing program?

Introduction

When you close your PC, and a macro is executed, it can be challenging to locate the infringing program responsible for the execution. In this blog post, we will explore ways to troubleshoot this problem and identify the culprit program.

Event Viewer

The first step in troubleshooting this issue is to use the Event Viewer. The Event Viewer is a tool that allows you to view detailed information about significant events on your computer. To access the Event Viewer, follow these steps:

1. Press the Windows Key + R to open the Run dialog box.
2. Type “eventvwr.msc” and click OK.
3. In the Event Viewer, click on “Windows Logs” on the left-hand side of the screen.
4. Click on “System.”
5. Look for any events that occurred around the time the macro was executed.
6. If you find an event that looks suspicious, click on it to view more details.

The Event Viewer can provide valuable information about the program responsible for executing the macro. However, it can be challenging to navigate, and the information can be difficult to interpret.

Task Manager

Another tool that can help troubleshoot this issue is the Task Manager. The Task Manager allows you to view all the programs currently running on your computer. To access the Task Manager, follow these steps:

1. Press the Ctrl + Shift + Esc keys to open the Task Manager.
2. Click on the “Processes” tab.
3. Look for any processes that look suspicious.
4. If you find a process that looks suspicious, right-click on it and select “Open File Location.”
5. Examine the file location to determine if it is a legitimate program or not.

The Task Manager can help identify the program responsible for executing the macro. However, it can be challenging to determine which program is responsible, especially if you have many programs running on your computer.

AutoHotkey

AutoHotkey is a program that allows you to automate tasks on your computer. It is possible that the macro that is executed when you close your PC is a script created in AutoHotkey. To determine if AutoHotkey is responsible for the macro, follow these steps:

1. Press the Windows Key + R to open the Run dialog box.
2. Type “shell:startup” and click OK.
3. Look for any shortcuts to AutoHotkey scripts.
4. If you find a shortcut to an AutoHotkey script, open it to view the script.
5. Examine the script to determine if it is responsible for the macro.

AutoHotkey can be an excellent tool for automating tasks on your computer. However, if used incorrectly, it can cause problems like the one you are experiencing.

Anti-Cheat Programs

If you have any anti-cheat programs installed on your computer, they may be responsible for the macro that is executed when you close your PC. Anti-cheat programs are designed to prevent cheating in online games by monitoring your computer for unauthorized programs. To determine if an anti-cheat program is responsible for the macro, follow these steps:

1. Open the folder where the anti-cheat program is installed.
2. Look for any scripts or programs that may be responsible for the macro.
3. If you find any suspicious scripts or programs, examine them to determine if they are responsible for the macro.
4. If you are unsure, contact the support team for the anti-cheat program for assistance.

Anti-cheat programs can be very effective at preventing cheating in online games. However, they can also cause problems like the one you are experiencing.

Conclusion

In conclusion, locating the program responsible for executing a macro can be challenging. However, by using tools like the Event Viewer and Task Manager, examining AutoHotkey scripts, and investigating anti-cheat programs, you can determine which program is responsible. If you are still having trouble, contact the support team for the program or seek assistance from a professional.

It sounds like you are experiencing an issue where certain programs are automatically opening when you log back in to your computer after locking it. Here are a few things you can try to troubleshoot this issue:

1. Check your startup programs: Some programs are configured to automatically start when you log in to your computer. You can check which programs are set to start automatically by going to the Start menu, typing “task manager” into the search bar, and then clicking on the “Startup” tab. From here, you can disable any programs that you don’t want to start automatically.
2. Check your autostart locations: In addition to startup programs, certain programs can also be configured to start automatically by placing a shortcut in one of the autostart locations on your computer. These locations include the Startup folder in your Start menu and the All Users Startup folder. To check these locations, go to the Start menu, type “shell:common startup” into the search bar, and then press Enter. This will open the All Users Startup folder. You can also go to the Start menu, type “shell:startup” into the search bar, and then press Enter to open the Startup folder for your user account.
3. Check for scheduled tasks: Some programs may be configured to start automatically by setting up a scheduled task in the Task Scheduler. You can check for scheduled tasks by going to the Start menu, typing “task scheduler” into the search bar, and then pressing Enter. From here, you can browse through the list of scheduled tasks to see if any of them are configured to start when you log in.
4. Check for hotkeys or macros: If you are using any hotkeys or macros that are configured to execute when you log in, they could potentially be causing the programs to open. You can check for hotkeys or macros by looking for any programs that are configured to start automatically and checking if they have any hotkeys or macros associated with them.
5. Check for malware: If you have ruled out the other possible causes, it’s possible that your issue could be caused by malware. You can scan your computer with an antivirus program to see if it finds any malware that could be causing the issue.

I hope these suggestions help! Let me know if you have any questions or if you need further assistance.

It took a considerable amount of time to discover the root cause of the issue. It seems that the problem is triggered by autohotkey software running on Windows.

Here is the specific code causing the problem:

sc05C up::
    Send, Overuse of formatting, such as ALL CAPS,
Return

The hotkey for International 6 using iCUE software (for Corsair gaming keyboards) is sc05C, and I have assigned it to my G13 key. The problem occurs even if iCUE is not running.

When I lock my computer with the Win + L shortcut, the sc05C hotkey is unexpectedly activated, and the macro starts running during the lock process. As a result, the Send string is called, but with the Win key pressed before the Send.

In essence, the following operation is taking place:

Send, {Win Down}Overuse of formatting, such as ALL CAPS,{Win Up}

The computer lock generally occurs before the letter “P” in the word “CAPS”.

It could have something to do with sc05C == vkEA, which the docs say:

0xE9-F5 | OEM specific

I conducted a test using vkEA and did not encounter the problem. My assumption is that sc05C was initially utilized because an older version of CUE v2 was incapable of correctly invoking vkEA. With the use of iCUE v3.27.68, vkEA now functions as intended.