I'm confused:
1) Wouldn't this show up as a process under task manager?
2) Wouldn't properly set security permissions require user assent for any downloads?
1. I think it did show up, but he needed to do further digging to find what it did, what it ran, etc.
2. No, as long as it doesn't need Administrative Access, it can do what it wants without a dialog. For most computers, downloading a file doesn't require UAC, so it can do it mostly undetected.