TSRs are for Dos. Dos cannot multitask, hence normally a program cannot stay resident after it terminates.

This doesn't apply to Windows programs, which can run at the same time any any other program, as long as there is enough ram etc.

Hooking Dos interrupts won't work for any recent version of Windows. Windows does not use Dos interrupts for its IO.

In order to achieve equivalent functionality, you must install kernel hooks, which is non-trivial, badly documented, and highly version specific.

Nevertheless, this is what Windows on-access antivirus programs do.

Slarty