在系统加载程序时检查文件是否被感染,程序中运用了钩子技术，文件主要分3部分，分别的运行，安装和反安装。-loading procedures in the system when checking if the file has been infected, to use the procedures hook, the paper's main points three parts, the operation, installation and anti-installed.

Rootkit detector to find system hook and user code hooks, hidden driver, hidden files, hidden proccess.,Rootkit detector to find system hook and user code hooks, hidden driver, hidden files, hidden proccess.