I still don't think you know what's really going on. But I'll humor you and ask for more info. Do you have a good task monitor? I recommend TaskInfo2002 which you can download from download.com. Get that, run it, look for your phantom process in it - and tell me what it says the cmd line is. This should be at least the path of the executeable.

And no there's no way you can save it from RAM unless the program itself gave you that option. It is possible, but the required tools do not exist, and it may not be something a tool can do. You'd have to write a program to specifically save that program. Also, the technique you refer to in having it execute and delete itself - isn't useful and therefor I don't see why anybody would do it. Rebooting the computer would cease its existance.
_________________________
Domain Registration, Hosting, Management
http://www.dollardns.net