1.打开cmd 后输入以下命令就可以结束进程：
方法一：利用进程的pid结束进程
命令格式：ntsd-c q-p pid
命令范例：ntsd-c q-p 1332（结束explorer.exe进程）
范例详解：explorer.exe的pid为1332，但是如何获取进程的pid呢？在cmd下输入taskl**t就可以获取当前任务管理器所有进程的pid。或者打开任务管理器，在菜单栏，选择“查看”—“选择列”，在打开的选择项窗口中将“pid（进程标识符）”项选择钩上，这样任务管理器的进程中就会多出pid一项了。（pid的分配并不固定，是在进程启动是由系统随机分配的，所以进程每次启动的进程一般都不会一样。可使用以下命令：
echo off
mode con cols=30 lines=5
color 1e
echo.
set/p t=请输入进程名:
taskl**t/fo csv>2.txt
find"%t%"2.txt>1.txt
for/f"delims=,tokens=2"%i in(1.txt)do set a=i
ntsd-c q-p%a%
echo pid name
echo=
echo%a%t%
del 1.txt
del 2.txt
pause>nul
exit
3.方法二：利用进程名结束进程
命令格式：ntsd-c q-pn*.exe（*.exe 为进程名,exe不能省）
命令范例：ntsd-c q-pn explorer.exe
另外的能结束进程的dos命令还有taskkill和tskill命令：
命令格式：taskkill/pid 1234/f（也可以达到同样的效果。如果上面这些还不能满足您的求知欲，下面还有：
ntsd详解
有一些高等级的进程,tskill和taskkill或许无法结束,那么我们还有一个更强大的工具,那就是系统debug级的ntsd.准确的说,ntsd是一个系统调试工具,只提供给系统开发级的管理员使用,但是对杀掉进程还是很爽的.基本上除了windows系统自己的管理进程,ntsd都可以杀掉。ntsd 调试程序在启动时要求用户指定一个要连接的进程。使用 tl**t 或 pviewer，可以获得某个现有进程的进程 id，然后键入 ntsd-p pid 来调试这个进程。ntsd 命令行使用如下的句法：
ntsd[options]imagefile
其中，imagefile 是要调试的映像名称。用法usage:ntsd[-?[-2][-d][-g][-g][-myob][-lines][-n][-o][-s][-v][-w]
[-r breakerrorlevel][-t printerrorlevel]
[-hd][-pd][-pe][-pt#][-pv][-x|-x{e|d|n|i}]
[-|-p pid|-pn name|command-line|-z crashdmpfile]
[-zp crashpagefile][-premote transport][-robp]
[-adllname][-c"command"][-i imagepath][-y symbolspath]
[-clines#][-srcpath sourcepath][-qr \\machine][-wake]
[-remote transport:server=name,portid][-server transport:portid]
[-ses][-sfce][-sicv][-snul][-noio][-failinc][-noshell]
where:-?d**plays th** help text
command-line ** the command to run under the debugger
** the same as-g-g-o-p-1-d-pd
adllname sets the default extension dll
c executes the following debugger command
clines number of lines of output h**tory retrieved by a remote client
failinc causes incomplete symbol and module loads to fail
d sends all debugger output to kernel debugger via dbgprint
d cannot be used with debugger remoting
d can only be used when the kernel debugger ** enabled
g ignores initial breakpoint in debuggee
g ignores final breakpoint at process termination
hd specifies that the debug heap should not be used
for created processes.th** only works on windows wh**tler.
o debugs all processes launched by debuggee
p pid specifies the decimal process id to attach to
pd specifies that the debugger should automatically detach
pe specifies that any attach should be to an ex**ting debug port
pn name specifies the name of the process to attach to
pt#specifies the interrupt timeout
pv specifies that any attach should be noninvasive
r specifies the(0-3)error level to break on(seeseterrorlevel)
robp allows breakpoints to be set in read-only memory
t specifies the(0-3)error level to d**play(seeseterrorlevel)
w specifies to debug 16 bit applications in a separate vdm
x sets second-chance break on ** exceptions
x{e|d|n|i}<event>sets the break status for the specified event
2 creates a separate console window for debuggee
i imagepath specifies the location of the executables that generated
the fault(see_nt_executable_image_path)
lines requests that line number **rmation be used if present
myob ignores version m**matches in dbghelp.dll
n enables verbose output from symbol handler
noio d**ables all i/o for dedicated remoting servers
noshell d**ables the.shell!command
qr<\\machine>queries for remote servers
s d**ables lazy symbol loading
ses enables strict symbol loading
sfce fails critical errors encountered during file searching
sicv ignores the cv record when symbol loading
snul d**ables automatic symbol loading for unqualified names
srcpath<sourcepath>specifies the source search path
v enables verbose output from debugger
wake wakes up a sleeping debugger and exits
y<symbolspath>specifies the symbol search path(see_nt_symbol_path)
z<crashdmpfile>specifies the name of a crash dump file to debug
zp<crashpagefile>specifies the name of a page.dmp file
to use with a crash dump
remote lets you connect to a debugger session started with-server
must be the first argument if present
transport:tcp|npipe|ssl|spipe|1394|com
name:machine name on which the debug server was created
portid:id of the port the debugger server was created on
for tcp use:port=
for npipe use:pipe=
for 1394 use:channel=
forcom use: port=<com port>,baud=,
channel=
for ssl and spipe see the documentation
example:.-remote npipe:server=yourmachine,pipe=foobar
server creates a debugger session other people can connect to
must be the first argument if present
transport:tcp|npipe|ssl|spipe|1394|com
portid:id of the port remote users can connect to
for tcp use:port=
for npipe use:pipe=
for 1394 use:channel=
forcom use: port=<com port>,baud=,
channel=
for ssl and spipe see the documentation
example:.-server npipe:pipe=foobar
premote transport specifies the process server to connect to
transport arguments are given as with remoting
environment variables:
nt_symbol_path=[drive:][path]
specify symbol image path.
nt_alt_symbol_path=[drive:][path]
specify an alternate symbol image path.
nt_debugger_extension_path=[drive:][path]
specify a path which should be searched first for extensions dlls
nt_executable_image_path=[drive:][path]
specify executable image path.
nt_source_path=[drive:][path]
specify source file path.
nt_debug_log_file_open=filename
if specified,all output will be written to th** file from offset 0.
nt_debug_log_file_append=filename
if specified,all output will be appended to th** file.
nt_debug_h**tory_size=size
specifies the size of a server's output h**tory in kilobytes
control keys:
enter>quit debugger
break into target
enter>force a break into debuggee(same as ctrl-c)
enter>debug current debugger
enter>toggle verbose mode
enter>print version **rmation
ntsd:exiting-press enter-
选项option：
2打开一个用于调试字符模式的应用程序的新窗口
d将输出重定向到调试终端-g 使执行自动通过第一个断点
g使 ntsd 在子程序终止时立即退出o启用多个进程的调试，默认值为由调试程序衍生的一个进程
p指定调试由进程 id 标识的进程
v产生详细的输出。例如，假设 inet**.exe 的进程 id 为 104。键入命令“ntsd-p 104”将 ntsd 调试程序连接到 inet** 进程(i**)。也可使用 ntsd 启动一个新进程来进行调试。例如，ntsd notepad.exe 将启动一个新的 notepad.exe 进程，并与它建立连接。一旦连接到某个进程，就可以用各种命令来查看堆栈、设置断点、转储内存，等等。命令含义~显示所有线程的一个列表kb 显示当前线程的堆栈轨迹~kb显示所有线程的堆栈轨迹r显示当前
帧的寄存器输出u反汇编代码并显示过程名和偏移量d[type][]转储内存bp设置断点bc[]清除一个或多个断点bd[]禁用一个或多个断点be[]启用一个或多个断点bl[]列出一个或多个断点。有很多病毒,木马,或者恶意软件,都喜欢把自己做成动态库,然后注册到系统正常程序的加载库列表中,达到隐藏自己的目的.
首先需要设置一下ntsd的输出重定向,最好是重定向到一个文本文件,方便分析研究.
c:\>set_nt_debug_log_file_append=c:\pdw.txt
注意,虽然输出重定向了,但是我的输出依然会继续显示在屏幕上,而且会进入到debug模式,我们使用-c q参数,就可以避免这个问题.
c:\>ntsd-c q-v notepad.exe
现在我们的pdw.txt文件中,就可以看见notepad.exe文件的调试信息。可以知道,ntsd的软件终止能力是很好很强大的,一些taskkill都无法终止的软件(如student.exe这一类或木马)可以用ntsd轻易终止。