I have alchool ok, it's not fully hidden on win64 I can still see a random named service in the service list, every reboot the name is different
with some tests on my pc and another one I've noticed that it's alchool that creates this service.
Many trojan use to create random named services, I known that alchool uses a kernel hook to hide
itself to advapi32 reg key functions, but your cloacking driver doesn't work in the same way
on 64bit windows, sptd driver is completely visible in system services and I can also see the sys file
the random named service acts as pnp device
CODE
ACPI\PNPA000\4&5d18f2df&0
Since I've noticed it and suspected something, readme and faqs were saying nothing
I strogly suggest to add in the faq that alchool on win64 creates random named fake services
on each reboot, since many trojan follow the same behavior and an user like
me can think about a malware.
I don't object about your techniques and on windows 32bit there are no fake service names (maybe the kernel hook works differently)
but an user should known what is that creates this fake services, so if I known it's alchool then I'm safe