This method uses hooking system services dispatch table, so as to monitor file system and registry table.

• 通过挂接系统服务，对注册表和文件系统进行监控，从而实现木马检测。