ntsd.exe

ntsd.exe下载，可用于强制结束进程，将此文件解压在C盘windows文件夹下即可

进程文件： ntsd or ntsd.exe
进程名称： Symbolic Debugger for Windows 。ntsd.exe是Microsoft Windows 2000系统自带的用户态调试工具。可用它结束掉除System、SMSS.EXE、CSRSS.EXE以外的所有进程。该程序经常被病毒利用，用来强制结束杀毒软件进程。

使用方法

NTSD（Microsoft Windows NT Symbolic/Systems Debugger）是Windows 2000（Microsoft Windows XP）默认安装的一

个调试器。这其实是一个命令行版本的WinDBG，功能上稍微缩了一点水，但是对一般的调试

来说是足够用了。

usage: NTSD [-v] [-2] [-d] [-o] [-g] [-G] [-w] [-lines]

[-aDllName] [-s] [-r BreakErrorLevel] [-t PrintErrorLevel]

[-hd] [-x | -xd [except#] | -xe [except#]] [-e] [-z]

[-- | -p pid | command-line]

where: -? displays this help text

-aDllName sets the default extension DLL

-c executes the following debugger command

指定要执行的调试命令，多个命令之间用“;”分隔

-d sends all debugger output to kernel debugger via DbgPrint

-g ignores initial breakpoint in debuggee

-G ignores final breakpoint at process termination

-hd disables heap manager validity checking

-i ignores AV generated by loader fixups on pre3.51 systems

-lines requests that line number information be used if present

-netsyms:{yes|no} allow or disallow loading symbols from a network path

-o debugs all processes launched by debuggee

-r specifies the (0-3) error level to break on (SeeSetErrorLevel)

-s disables lazy symbol loading

-t specifies the (0-3) error level to display (SeeSetErrorLevel)

-v enables verbose output from debugger

-n enables verbose output from symbol handler

-w specifies to debug 16 bit applications in a separate VDM

-x disables break on AV exceptions

-xd disables stopping on specified exception

-xe enables stopping on specified exception

-z reserved for OS/2 debugging

-2 creates a separate console window for debuggee

对于控制台程序，将输出定向到另一个窗口而不在NTSD窗口显示

-- is the same as -G -g -o -p -1

-p pid specifies the decimal process Id to attach to

指定要调试的进程号，用于调试已经运行的程序

command-line is the command to run under the debugger

Environment Variables:

_NT_SYMBOL_PATH=[Drive:][Path]

Specify symbol image path. (Default = %SystemRoot%)

_NT_ALT_SYMBOL_PATH=[Drive:][Path]

Specify an alternate symbol image path.

_NT_DEBUG_EXTENSIONS=dllname(s)

If specified, it is a semi-colon separated list of debugger extension DLL names

This specifies the search order when resolving debugger extension commands

A [