The invention discloses a spyware analysis method and a computer system, and belongs to the field of communication technologies. The method includes the steps that the computer system captures an execution trace for executing progress of spyware; then a subprogram for data package passing back operation is extracted from the execution trace, wherein the data package passing back operation is that the computer system transmits a data package to a control host when the computer system executes the progress of the spyware; semantic information of each constituent part in information of calling interfaces contained in the subprogram for the data package passing back operation is analyzed and output. Thus, a specific format of the data package passed back by the computer system when the computer system calls the spyware to be in communication with the control host can be confirmed, then a communication protocol of the spyware can be acquired, a user can rewrite a control command of the spyware according to the acquired communication protocol to control execution of the spyware, and therefore user information disclosure can be avoided.