The processes are not restaring themselves but being restarted by another “watchdog” process- so it’s important to suspend all the malware processes before killing them.
This is the PP slide from Mark’s lecture on the subject:
Terminating Malicious Processes
Don’t kill the processes
Malware processes are often restarted by watchdogs
Instead, suspend them
Note that this might cause a system hang for Svchost processes
Record the full path to each malicious EXE and DLL
After they are all asleep then kill them
Watch for restarts with new names…
