Sample Macro

Scan for Banned Programs

Written by Kevin Heaton, Insight Software Solutions, Inc.

What it does

Scans the processes running on your computer to see if a dangerous or banned program is running.

To install

Download the macro file umscanbanned.zip and save it to your hard drive. Unzip the files and save them in the folder where you store your macro file(s). Import the macros into your existing macro file by clicking File, Import, Import Macros.

To use

Run the macro by pressing Win+Alt+B. A message is spoken and a dialog displayed if a banned program is running. You may want to change this to a scheduled macro. If you do, you would want to either mute the spoken messages or remove the ‘done’ message that is spoken when the macro ends.

Update the list of banned programs by editing blprocs.txt with a text editor.

How it works

Using the Repeat with Processes command causes the macro to loop once for each process that is running on your computer. It then uses the ASCII File Begin/End Process commands to look for that process in a list of banned programs. The banned programs are contained in a blacklist file. The blanklist file, named blprocs.txt, contains the name of the .exe and a description. A sample blacklist file is included.

This macro uses the Variable Set from Misc and Read Registry String commands to determine the folder where the macro is located and looks for the blacklist and sound files in the same folder.

Another feature of this macro is the ability to tell the user what is going on using several sound files. By modifying the macro you can choose one of three voices to use for the spoken messages.

Limitations

This only looks for program files (.exe files). It cannot identify a .dll file.

This macro is intended to supplement, not replace, other protection software such as anti-virus and spyware detection and removal programs. Use of this macro may provide an early warning of malware.

Requirements

– Macro Express 3.5 or later
– blprocs.txt – A file containing a black list of processes (banned programs)
– ErrorF1.wav, errorM1.wav or errorF3.wav
– BannedProgramFoundF1.wav, BannedProgramFoundM1.wav or BannedProgramFoundF3.wav
– DoneF1.wav, doneM1.wav or doneF3.wav