It is a possible zero access or conserv infection based on this but C:\windows\assembly\tmp\u\00000002 I will need to check first before I can decide the approach to take

Once you have run and attached the scans we will go from there