How to find exact match using PSLIST and FIND in Batch/CMD

3
votes

I am trying to find a running process and kill it using PSLIST and PSKILL however, I'm unable to get the errorlevel to set properly. Depending on the way I do it, it gets stuck on either 0 or 1. I originally had the code working the Taskkill and Tasklist commands, but the code has to run on Windows 2000 as well as XP.

I also have notepad++ running to edit the batch file. The following code doesn't differentiate between notepad++ or notepad.exe.

@echo off

reg.exe ADD "HKCU\Software\Sysinternals\PsKill" /v EulaAccepted /t REG_DWORD /d 1 /f >NUL
reg.exe ADD "HKCU\Software\Sysinternals\PsList" /v EulaAccepted /t REG_DWORD /d 1 /f >NUL

rem just to see output of pslist
PSLIST "notepad" 2>NUL
ECHO.
ECHO. 
PSLIST "notepad" 2>NUL | FIND /I /N "notepad"
echo The error level is %errorlevel%


IF %errorlevel% EQU 0 (
    ECHO Notepad is running and will be terminated.
    ECHO.
    PSKILL "notepad.exe" 2>NUL
)
IF %errorlevel% EQU 1 (
    ECHO Notepad was not running.
    ECHO Starting Notepad now...
    ECHO.
    start "" "notepad.exe"
)

Pause
EXIT

The above code gets stuck on 0. When I change the line with FIND command to FINDSTR as PSLIST "notepad" 2>NUL | FINDSTR /I /N "notepad.exe" then it gets stuck on 1.

Is there a way to get the PSLIST and FIND or FINDSTR command to return the correct errorlevel with an exact match?

2
batch-filecmdfinderrorlevel

2 Answers

3
votes

How about using the -e parameter of pslist?

pslist -e notepad

It will set errorlevel to 0 when found, and 1 when not found. Also it is an exact match meaning it will not identify notepad++.

PSList Help

pslist v1.3 - Sysinternals PsList
Copyright (C) 2000-2012 Mark Russinovich
Sysinternals - www.sysinternals.com

Usage: pslist [-d][-m][-x][-t][-s [n] [-r n] [\\computer [-u username][-p password][name|pid]
   -d          Show thread detail.
   -m          Show memory detail.
   -x          Show processes, memory information and threads.
   -t          Show process tree.
   -s [n]      Run in task-manager mode, for optional seconds specified.
               Press Escape to abort.
   -r n        Task-manager mode refresh rate in seconds (default is 1).
   \\computer  Specifies remote computer.
   -u          Optional user name for remote login.
   -p          Optional password for remote login. If you don't present
               on the command line pslist will prompt you for it if necessary.
   name        Show information about processes that begin with the name
               specified.
   -e          Exact match the process name.
   pid         Show information about specified process.

All memory values are displayed in KB.
Abbreviation key:
   Pri         Priority
   Thd         Number of Threads
   Hnd         Number of Handles
   VM          Virtual Memory
   WS          Working Set
   Priv        Private Virtual Memory
   Priv Pk     Private Virtual Memory Peak
   Faults      Page Faults
   NonP        Non-Paged Pool
   Page        Paged Pool
   Cswtch      Context Switches
2
votes

try this (displays only the interesting line):

PSLIST "notepad++" 2>NUL | FINDstr /I "notepad++"
echo %errorlevel%
PSLIST "notepad" 2>NUL | FINDstr /I "notepad[^+]"
echo %errorlevel%