PUA:Win32/Slimware removal guide

The PUA:Win32/Slimware is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUA:Win32/Slimware virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Unconventionial language used in binary resources: Japanese

How to determine PUA:Win32/Slimware?


File Info:
name: A28B45613464C9BC64A3.mlw
path: /opt/CAPEv2/storage/binaries/89592443cfaaa7280a48f1240f59e1afcc90f1088cde474264c82fbc81235b7d
crc32: 7A328123
md5: a28b45613464c9bc64a30893e4e37ac5
sha1: c73d37eec4da5a7f69f73d67bd58d8636b9ca637
sha256: 89592443cfaaa7280a48f1240f59e1afcc90f1088cde474264c82fbc81235b7d
sha512: cb3c1847fe24e96645638391d16517d0e2d5faf0ce38bc3420d178e52ee33dc525f57a44a20f0638d69ea8cceb10473380655f009dbedc6c6f53d5af358fb9b2
ssdeep: 12288:fHwvQ2XK9Vh8j/hKX/tXKTYvnqFo78CcCUKmuP6:o4gdK1kYvb8C5R7P6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T140154A137AE4B439E6E643795FA6D1E4ABEF38518F32E10B768C430B092548DD367362
sha3_384: a6722d33869b2969d10f29359cf00f03aca6f02eaa5c8de04f09df77764bd9604a7d3767d8c917434e05bb55a098733d
ep_bytes: e88b7b0000e917feffff8b44240485c0
timestamp: 2015-10-27 14:07:51

Version Info:
CompanyName: Slimware Utilities, Inc.
FileDescription: DriverUpdate Setup Wizard
FileVersion: 2.5.0
InternalName: LittleInstaller
LegalCopyright: Copyright Slimware Utilities, Inc. 2011-2015
OriginalFilename: DriverUpdate-setup.exe
ProductName: DriverUpdate
ProductVersion: 2.5.0
Translation: 0x0409 0x04b0

PUA:Win32/Slimware also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
FireEye	Generic.mg.a28b45613464c9bc
Skyhigh	BehavesLike.Win32.Slimware.dh
Cylance	unsafe
K7AntiVirus	Adware ( 0051fb711 )
K7GW	Adware ( 0051fb711 )
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Slimware.A potentially unwanted
Cynet	Malicious (score: 100)
SUPERAntiSpyware	PUP.Slimware/Variant
Rising	Trojan.Generic@AI.100 (RDMK:TI2t0JTHT6GKOMiGkiyfug)
DrWeb	Program.Unwanted.1093
Sophos	DriverUpdate – Slimware Util (PUA)
Google	Detected
Antiy-AVL	GrayWare/Win32.Slimware
Kingsoft	malware.kb.a.876
Microsoft	PUA:Win32/Slimware
GData	Win32.Application.DriverUpdater.D
Varist	W32/SlimWare.H.gen!Eldorado
VBA32	BScope.Adware.Plugin
Malwarebytes	PUP.Optional.DriverUpdate.DDS
Yandex	Riskware.Unwanted!h86g5ywozn0
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Slimware
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_100% (D)

How to remove PUA:Win32/Slimware?

PUA:Win32/Slimware removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X