328 8995 A0FEFFFF mov dword ptr ss:[ebp-160],edx
004CF32E 1195 D0FEFFFF add dword ptr ss:[ebp-130],edx
004CF334 8DB5 14FFFFFF lea esi,dword ptr ss:[ebp-EC]
004CF33A 1116 add dword ptr ds:[esi],edx
修改成如下(红色部分)
004CF302 E8 00000000 call 复件_(2).004CF307
004CF307 5D pop ebp
004CF308 83C5 F9 add ebp,-7
004CF30B 8D85 0CFFFFFF lea eax,dword ptr ss:[ebp-F4]
004CF311 8338 01 cmp dword ptr ds:[eax],1
004CF314 0F84 47020000 je 复件_(2).004CF561
004CF31A C700 01000000 mov dword ptr ds:[eax],1
004CF320 8BD5 mov edx,ebp
004CF322 2B95 A0FEFFFF sub edx,dword ptr ss:[ebp-160]
004CF328 8995 A0FEFFFF mov dword ptr ss:[ebp-160],edx
004CF32E 1195 D0FEFFFF adc dword ptr ss:[ebp-130],edx
004CF334 8DB5 14FFFFFF lea esi,dword ptr ss:[ebp-EC]
004CF33A 1116 adc dword ptr ds:[esi],edx
之后保存文件，用卡巴扫描，不再报毒。
二、FSG2.0的测试
OD载入被FSG2.0加了壳的DT
复制出前十几行，如下
00400154 f> 8725 2C115300 xchg dword ptr ds:[53112C],esp
0040015A 61 popad
0040015B 94 xchg eax,esp
0040015C 55 push ebp
0040015D A4
