Following our skeleton of a monitoring software which is now in the form of an NT Service:
1. Have a single service with no additional executables.
2. Have the service start a thread like you have described
3. Bypass UAC
4. Hide the files and registry values using the [url removed, login to view] we sent you in the past
5. Hide the process
6. Full code review and bug fixes
7. Add enhancements such as chat monitoring, integration with our Configuration Tool and enhance the various ways to transmit collected data to the operators.