Chanassa

Hi, this may be a dumb question. But how does the "hacker" do this? Where is the file? Locally or on server? Do it run as an process or something? Is it possible to make a "counter" script, one that detects for example the process?