They are hooking kernel level API functions. This means that every time a user mode application tries to access the filesystem, it calls Norton's hooked functions. Norton could make the filesystem...