A system for detecting real-time system file intrusions in a user computer that is coupled to an administrator computer and includes an operating system and system files. At a boot time of the user computer, an application program interface (API) of the operating system receives a list of vital system files that consists of at least two directory files. At the boot time, one of more daemons are launched, after which the API detects one or more system calls made to one or more vital system files. The API raises an automatic interrupt ‘I’ command that awakens a daemon from a sleep mode. The awakened daemon catches the interrupt ‘I’ command and sends an alert message to the administrator computer to alert the administrator computer of the detecting of the system call made to the one or more vital system files.