I ran the following script to document all the processes that are running in the system each minute.
I got surprising results from my analysis. The multiple instances don't appear in the processes list at all. However, two processes "smartscreen.exe" and "SystemIdleCheck.exe" started immediately after the closing of instances of this unknown process. Both "smartscreen.exe" and "SystemIdleCheck.exe" were purportedly closed by malware earlier. My analysis is, that somehow this process is able to hide it from the process managers.
Please suggest what should I do. This is driving me crazy.
:start
set /a var+=1
if %var% EQU 100000 goto end
echo %var%
tasklist > c:\process_dump\process_list_%var%.txt
timeout 60 > NUL
goto start
:end
echo var has reached %var%.
pause
exit