2

How can I get the process name from computer memory by using loop depending on the process description ?

Example:

My program name is "dev.exe" in memory and its description is "a tool for helping php developers"

Is there any way to find my process name by using process description even if the user change the name?

Can we do this an autoit or cmd or wmic?

  • Just an idea. In principle you can have the list of all the processes, then the executable name and path; when the size matches you can run something like md5sum and check if they are the same file, or you can extract, if present, the internal name and version. (Some programs have compiled inside their name...) How to list processes can give you more than one hint... – Hastur May 16 '16 at 10:43
  • please any help ?? – Qassam Mahmoud May 18 '16 at 17:05
  • @QassamMahmoud I have presented two PowerShell solutions in my answer. – DavidPostill May 29 '16 at 21:37
2

How do I find a running Process Name given it's "File description" property value?

Improved solution (thanks to @BenN following discussion in chat):

Use the following PowerShell Script (Get-ProcessName.ps1).

$_match=$Args[0].ToLowerInvariant()
Get-Process | where {$_.Description -ne $null -and $_.Description.ToLowerInvariant().Contains($_match)} | select Path, Description, ProcessName

Notes:

  • The first parameter passed to the script is used to perform a case insensitive search within the "File description" property value.
  • Passing "notepad" will match both "notepad.exe" and "notepad++.exe" if they are both running.

Example output:

PS F:\test> .\Get-ProcessName notepad

Path                                                               Description                                                        ProcessName
----                                                               -----------                                                        -----------
C:\Windows\system32\notepad.exe                                    Notepad                                                            notepad
E:\LiberKey\Apps\Notepad++\App\Notepad++\notepad++.exe             Notepad++ : a free (GNU) source code editor                        notepad++
E:\LiberKey\Apps\Notepad++\App\Notepad++\notepad++.exe             Notepad++ : a free (GNU) source code editor                        notepad++


PS F:\test>

Original solution:

Use the following Powershell Script (Get-ProcessName.ps1).

$_name=$Args[0]
$_match="*"+$Args[0]+"*"
Get-Process | ForEach {
  if ($_.Path) {
    $_filedescription=(Get-Item $_.Path).VersionInfo.FileDescription 
    if ($_filedescription -like $_match) {
      Write-Output "File Description: '$_filedescription', Process Path: '$($_.Path)', Process Name: '$($_.ProcessName)'"
      }
    }
  }

Notes:

  • The first parameter passed to the script is used to perform a "wildcard" case insensitive search within the "File description" property value.
  • If you pass string it will search using *string* and will match string anywhere within the "File description" property
  • Passing "notepad" will match both "notepad.exe" and "notepad++.exe" if they are both running.
  • The script outputs the "File Description", "Process Path" and "Process Name.

Example output:

PS F:\test> .\Get-ProcessName notepad
File Description: 'Notepad', Process Path: 'C:\Windows\system32\notepad.exe', Process Name: 'notepad'
File Description: 'Notepad++ : a free (GNU) source code editor', Process Path: 'E:\LiberKey\Apps\Notepad++\App\Notepad++\notepad++.exe', Process Name: 'notepad++'
File Description: 'Notepad++ : a free (GNU) source code editor', Process Path: 'E:\LiberKey\Apps\Notepad++\App\Notepad++\notepad++.exe', Process Name: 'notepad++'
PS F:\test>

Notes:

  • "notepad++.exe" has two processes in memory when running the portable version.
0

I found this link trying to solve the same problem. Building off the existing answer, a simple line that can be added to an existing script:

 Get-Process | where {$_.Description -like '*note*'} | select Path, Description, ProcessName

Example output:

    Path                                                         Description          ProcessName
----                                                         -----------          -----------
C:\Windows\system32\notepad.exe                              Notepad              notepad
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE  Microsoft OneNote    ONENOTE
C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE Send to OneNote Tool ONENOTEM

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.