在系统加载程序时检查文件是否被感染,程序中运用了钩子技术，文件主要分3部分，分别的运行，安装和反安装。-loading procedures in the system when checking if the file has been infected, to use the procedures hook, the paper's main points three parts, the operation, installation and anti-installed.