Windows 10: exe virus

I received an e:mail from what I thought was a trustworthy source with a PDF attached. I downloaded/opened the PDF I could see an exe and it's now affecting the performance of my computer. I keep getting this window/screen refresh every few minutes and i can sometimes see dos coding in the background. I have a screen shot of the message which reads replace or skip files "copying 4 items from rdhas to temp". Microsoft Support has run various diagnostics, malware and sfc scans and yet this message keeps popping up. I appreciate the help

:)

 

NESHTA.A VIRUS REMOVED BUT .EXE NOT WORKING

Hi Khaled,

It is possible that you .exe is not working due to corrupted system files or account. To assist you better, kindly answer the following questions:

• Does this happen with a specific application or with all of your application?
• Have you tried creating a new admin account to check if the issue also with new account or only with the current account?

In the meantime, we suggest that you follow the steps in this article on how
to create a new admin account.

Let us know if you need further assistance.

 

How to remove Gallery.exe (Virus)

I've been dealing with a virus named "Gallery.exe," and despite my best efforts, it keeps coming back. I've taken several steps to remove it, including formatting my disk, but it still manages to return. I was able to spot this suspicious exe running in my background, I tried my best to find it's location but it kept opening File Explorer with no signs of that exe. When I opened the exe location using Task Manager it opened 'C:\Users\[username]\AppData\Roaming". I could not see the exe in that location, I somehow opened the exe properties and saw the hidden option on it was greyed out. So I used the command "attrib -h -s /s /d" to unhide the file and then I was able to see it. I deleted the file but then, it kept coming back with every restart. Since then, my windows is going insane, the Windows anti-virus keeps deleting genuine files like, AMD Software, Google Chrome, and windows apps itself. My different apps started behaving weird and all.

What I've Tried So Far:

• Formatting the disk and performing a clean install of the operating system.
  
• Running multiple antivirus and anti-malware scans.
  
• Installing all available Windows updates and patches.
  

Unfortunately, none of these attempts have been successful in permanently removing this pesky virus.

System Information:

• Operating System: Windows 11
  

Specific Questions:

1. Has anyone encountered a similar virus issue and successfully removed it? If so, could you please share your experience and the steps you took?
   
2. Are there any known vulnerabilities or software that "Gallery.exe" may exploit to keep reappearing?
   

I'm open to any advice, suggestions, or guidance you can provide. My goal is to get my computer back to a virus-free state and ensure it remains that way.

Thank you in advance for your help and support. Your expertise is greatly appreciated!

Best regards, Rehan Ramay

 

Malware tprdpw64.exe after installing 7zip

Thank you for the reply and the suggestions. However neither link provided a working solution. I followed each set of instructions step by step, to the T, but the viruses are still there.

I killed the processes with Rkill as instructed, and it found and ended the malware process `tprdpw64.exe`. It, however, did nothing
about the adware `svcvmx` & `svcvmx client` processes. After doing so I downloaded and installed Zemana, as instructed, and let it do a full system scan. Might I add that this took over
10 hours to complete, as I have 1,396,541 files on my PC, so this whole thing wasted nearly half a day of my time with no results.

Zemana detected the malware virus `tprdpw64.exe` located at "C:\WINDOWS\System32\tprdpw64.exe"
(among other, smaller "threats"), and labeled it as malware. After it finished the scan, it said it has placed all files into quarantine, including `tprdpw64.exe`.
However, when checking the quarantine list `tprdpw64.exe` is
not listed. I then decided to have Zemana remove the files in the
quarantine list from my system and then rebooted my PC. It removed them all successfully, except for `tprdpw64.exe`
which is still on my system, and still runs (I can still see it in task manager after rebooting). So the 10+ hours of waiting were all for nothing.

I then used Zemana's "drag-and-drop" feature to re-scan just `tprdpw64.exe`
(in order to not have to wait 10+ hours again). It scanned it, and now says the file is not a threat (but it clearly is).

I then proceeded to step 2, using AdwCleaner to remove the adware. This did not work in the slightest. AdwCleaner did not detect the adware virus at all, and thus did nothing about it. I still cannot remove the viruses manually, either. However for some
reason, the adware `svcvmx` & `svcvmx client` processes no longer seem to run (my PC has been on for about an hour, and the processes
have yet to startup). However, even so the files are still on my file system and would like to delete them.

EDIT

I have just searched my registry, looking for any possible signs of tprdpw64 being listed, and there was nothing there.