偶然的机会试了一下大神的rootkit扫描工具，启动时竟然直接崩溃，break进了windbg：(36cc.328): Access violation - code c0000005 (!!! second chance !!!)*** ERROR: Module load completed but symbols could not be loaded for C:\Users\ge\Downloads\RootkitRevealer.exeeax=ffffffff ebx=004aa634 ecx=c0100000 edx=0019f1fc esi=00000000 edi=02fc0048eip=004040cd esp=0019f1ec ebp=0019f1f0 iopl=0 ...

文件清单哦

Folder PATH listingC:.│   tree.txt│   ├───Audio│   ├───portcls│   │   ├───inc│   │   │       kso.h│   │   │       ksshellp.h│   │   │       pcwpptr.h│   │   │       perf.h│   │   │       ...