How to remove SlowStepper

What is SlowStepper

SlowStepper is a sophisticated backdoor-type malware that poses significant threats to system security and user privacy. Developed around 2019, it is linked to the Chinese threat actor group PlushDaemon, targeting regions such as China, Hong Kong, Taiwan, South Korea, New Zealand, and the United States. This malware utilizes multiple modules written in C++, Python, and Go, exploiting DLL side-loading techniques to execute its payload. Upon infiltrating a system, SlowStepper collects extensive device data and can execute various malicious commands, including installing additional modules, managing files, and exfiltrating sensitive information. It targets applications and services like Telegram, WeChat, and DingTalk, extracting data such as browsing histories, passwords, and credit card numbers from popular browsers. The malware’s ability to adapt and evolve means it could incorporate new functionalities and targets in future iterations, making it a persistent threat. Its presence can lead to severe privacy issues, financial losses, identity theft, and multiple system infections. To mitigate the risks associated with SlowStepper, it is crucial to employ robust cybersecurity practices, including the use of reliable antivirus software and cautious browsing habits.

How SlowStepper infected your system

SlowStepper infiltrates computers primarily through compromised legitimate websites and trojanized software updates, exploiting unsuspecting users who download what appears to be genuine applications. Particularly, the malware has been known to exploit legitimate sites that had been hacked, embedding itself into software installers, such as the notable attack on a South Korean VPN software’s website in 2023. Beyond this, SlowStepper may be disseminated through phishing campaigns, where malicious attachments or links in emails trick users into executing the malware. It also utilizes social engineering tactics, often masquerading as software cracks or fake updates that lure users into downloading infected files. These files can come in different formats, including executables, archives, and documents, which, once opened, initiate the infection chain. Moreover, SlowStepper can self-propagate across local networks and removable devices, making it a persistent threat that exploits multiple vectors to ensure widespread infiltration.

1. Download SlowStepper Removal Tool
2. Use Windows Malicious Software Removal Tool to remove SlowStepper
3. Use Autoruns to remove SlowStepper
4. Files, folders and registry keys of SlowStepper
5. Other aliases of SlowStepper
6. How to protect from threats, like SlowStepper

Remove SlowStepper manually

Manual removal of SlowStepper by inexperienced users may become a difficult task because it does not create entries in Add/Remove Programs under Control Panel, does not install browser extensions, and uses random file names. However, there are pre-installed instruments in the Windows system, that allow you to detect and remove malware without using third-party applications. One of them is Windows Malicious Software Removal Tool. It comes with Windows Update in Windows 11, 10, 8. 8.1. For older operating system you can download it here: 64-bit version | 32-bit version.

Remove SlowStepper using Windows Malicious Software Removal Tool

1. Type mrt in the search box near Start Menu.
2. Run mrt clicking on found item.
3. Click Next button.
4. Choose one of the scan modes Quick scan, Full scan, Customize scan (Full scan recommended).
5. Click Next button.
6. Click on View detailed results of the scan link to view the scan details.
7. Click Finish button.

Remove SlowStepper using Autoruns

SlowStepper often sets up to run at Windows startup as an Autorun entry or Scheduled task.

1. Download Autoruns using this link.
2. Extract the archive and run Autoruns.exe file.
3. In Options menu make sure there are checkboxes near Hide Empty Locations, Hide Microsoft Entries, and Hide Windows Entries.
4. Search for suspicious entries with weird names or running from locations like: C:\{username}\AppData\Roaming.
5. Right-click on suspicious entry and choose Delete. This will prevent the threat to run at startup.
6. Switch to Scheduled Tasks tab and do the same.
7. To remove files themselves, click on suspicious entries and choose Jump to Entry…. Remove files or registry keys found.

Remove files, folder and registry keys of SlowStepper

SlowStepper files and folders


{randomname}.exe


SlowStepper registry keys


no information


Aliases of SlowStepper

How to protect from threats, like SlowStepper, in future

Standard Windows protection or any decent third-party antivirus (Norton, Avast, Kaspersky) should be able to detect and remove SlowStepper. However, if you got infected with SlowStepper with existing and updated security software, you may consider changing it. To feel safe and protect your PC from SlowStepper on all levels (browser, e-mail attachments, Word or Excel scripts, file system) we recommend a leading provider of internet security solutions – BitDefender. Its solutions both for home and business users proved to be one of the most advanced and effective. Choose and get your BitDefender protection via the button below:

Download BitDefender