if i don't want to hide the process i prefer to have a watcher process for the main process and when main process get killed the watcher process will restart it and vice versa.

thanks both of you.
rootkit has several main problem and the vb code works only for XP.