a technique i have used is to run two processes -- let's say your app is tracker.exe, i would use tracker.exe and tracker_helper.exe. basically in both apps, use the WaitForSingleObject function, to wait for the other's process handle. if it is killed, just respawn the other process again. of course this will be conspiciouos, if you want to stop people from seeing that you are doing this, maybe use srvtasks.exe or something kernel-sounding for the second one and put it in a system folder. (possibly ????) still, if the user knew what they were doing, they could write an app to kill both processes simultaneously. if you don't want that, you can probably write a security descriptor for you main process and apply it somehow (sorry, can't help you there). if you have norton antivirus you can try to kill navapscv.exe and see what i mean. hope that helps