You can bury a service into a svchost process, and then it is "hidden" in a sense, so it is hard to keep them from showing. I wrote a "snooper" program a while back which would allow the boss and me to take snapshots of other people's desktops to see if they were f-ing off. It was a lot of fun since I wrote in a few other "trinkets" as well
. The best part was seing what the boss was up to. He was the worst of the bunch by far. It was a lot of work however to hide the sucker because it used WinSockets which like to crash on it's own (Windows 95/98 days), and when you took a screen shot, a lot of memory would swap on the user's box giving away the snapshot process. I semi-solved that one by snapshooting a percent of the screen, compressing it and sending it in succession.
I could have made a great back-door virus out of it if I wished as I could manipulate files pretty well too. I used it mostly to back up files of people who always forgot to. Weren't they suprised when I saved thier butts when thier machines crashed!