Windows 10: Is it possible that wuaucltcore.exe file is malware on my PC?

Hello, on my PC there is a file called wuaucltcore.exe I have investigated and it says that the normal thing is that it should be in the system32, but in my case it is located in C: / Windows / Uss / amd64 I saw an answer in this forum and they indicate that it could be malware, but my case is somewhat special, it all started first when turning on the resolution of my PC it went down to a lower one of 1600x900, I investigated and it said that it could be because Windows was out of date, I saw in Windows update that there is a new version of Windows 11 that should be the most current that they

:)

 

Malware tprdpw64.exe after installing 7zip

Thank you for the reply and the suggestions. However neither link provided a working solution. I followed each set of instructions step by step, to the T, but the viruses are still there.

I killed the processes with Rkill as instructed, and it found and ended the malware process `tprdpw64.exe`. It, however, did nothing
about the adware `svcvmx` & `svcvmx client` processes. After doing so I downloaded and installed Zemana, as instructed, and let it do a full system scan. Might I add that this took over
10 hours to complete, as I have 1,396,541 files on my PC, so this whole thing wasted nearly half a day of my time with no results.

Zemana detected the malware virus `tprdpw64.exe` located at "C:\WINDOWS\System32\tprdpw64.exe"
(among other, smaller "threats"), and labeled it as malware. After it finished the scan, it said it has placed all files into quarantine, including `tprdpw64.exe`.
However, when checking the quarantine list `tprdpw64.exe` is
not listed. I then decided to have Zemana remove the files in the
quarantine list from my system and then rebooted my PC. It removed them all successfully, except for `tprdpw64.exe`
which is still on my system, and still runs (I can still see it in task manager after rebooting). So the 10+ hours of waiting were all for nothing.

I then used Zemana's "drag-and-drop" feature to re-scan just `tprdpw64.exe`
(in order to not have to wait 10+ hours again). It scanned it, and now says the file is not a threat (but it clearly is).

I then proceeded to step 2, using AdwCleaner to remove the adware. This did not work in the slightest. AdwCleaner did not detect the adware virus at all, and thus did nothing about it. I still cannot remove the viruses manually, either. However for some
reason, the adware `svcvmx` & `svcvmx client` processes no longer seem to run (my PC has been on for about an hour, and the processes
have yet to startup). However, even so the files are still on my file system and would like to delete them.

EDIT

I have just searched my registry, looking for any possible signs of tprdpw64 being listed, and there was nothing there.

 

Possible malware in fake explorer.exe file

When I boot my PC and open Task Manager a second explorer.exe shows up after about 1 minute (and generally has a high resource usage which is not shown in the screenshot below). When I open file location from the Task Manager, it goes win C:/Windows, but when I run Glary Utilities, it shows up in my Startup Manager Scheduled Tasks (which it didn't before), and when I open the file location through Glary, the location is: C:\Users\Hazu\AppData\Roaming\Microsoft . It is a hidden file, and from explorer properties and the file properties (which I can only access through Glary as it's hidden), both have hidden greyed so I am unable to show the file in that manner. I've run multiple scans from Bitdefender/Malwarebytes/Windows Security, but none of them have given alerts.



I'm not 100% sure it's a virus, but everything I can find concerning this issue suggests that it is. I've turned off startup access in Glary and removed all permissions in the properties, but I'm stumped on how to remove or quarantine it permanently. Any advice would be appreciated. Windows 10 Pro Version 21H2 (OS Build 19044.1766)

 

Remove .exe files caused by malware

You may do it easily with PowerShell, try open Windows PowerShell as administrator and type the following:

Remove-Item f:\malware\* -include .exe

Make in f:\malware\* add the name of the driver and folder and * is meaning all subfolders within the malware folder. if you want it within the driver you may write something like f:\* and -include .exe will remove all files with .exe extension.