3 ms·
I just followed Lenovo’s instructions [0] to uninstall SuperFish on a friend’s computer (Lenovo Yoga 2, Win 8.1). These instructions are NOT sufficient. After u
by reirob 12y ago
I just followed Lenovo’s instructions [0] to uninstall SuperFish on a friend’s computer (Lenovo Yoga 2, Win 8.1). These instructions are NOT sufficient. After uninstalling SuperFish through the normal windows uninstallation program, and the Root CA certs for IE and Firefox, suddenly none of the HTTPS sites worked! The browser complained (rightly), that the the certificate is wrong because it is signed by SuperFish.
I had to do some research to detect, that there is still a service called VisualDiscovery, which is activated on startup. Looking in the properties I can see that it starts “C:\Program Files (x86)\Lenovo\VisualDiscovery\VisualDiscovery.exe”. I stopped it and now it works as supposed. But I still have to find a way how to uninstall this stuff.
I’m a Linux guy, but I find it crazy, that after uninstalling VisualDiscovery/SuperFish there are still executables and a service remaining on the disk. This is crazy.
[0] http://support.lenovo.com/us/en/product_security/superfish_uninstall http://support.lenovo.com/us/en/product_security/superfish_u...
- DAllison 12y ago(Apologies if the formatting is problematic, my first post). 1. Stop the service: sc stop VisualDiscovery 2. Open up your favourite process manager and remove any superfish processes (containing the word superrfish). 3. Perform the uninstall via Add/Remove Programs (under superfish) 4. Confirm %ProgramFiles%/Lenovo/VisualDiscovery is deleted. 5. Open System32 and confirm there are no files beginning with VisualDiscovery 6. Open AppData and confirm that no files start with VisualDiscovery 7. Remove certificates (Firefox and Global). 8. Remove from Registry: HKLM\SOFTWARE\Wow6432Node\VisualDiscovery. After that, VisualDiscovery should be fully removed.
- reirob 12y agoThank you, I'll try this. But why is it not in Lenovo's instructions? After following only their instructions, you are in a worse state than before, i.e. SuperFish still working, but without root CAs, browsers shouting (good so), and users panicking.
- sharth 12y agoThere's also these instructions from Ars Technica: http://arstechnica.com/security/2015/02/how-to-remove-the-superfish-malware-what-lenovo-doesnt-tell-you/ http://arstechnica.com/security/2015/02/how-to-remove-the-su...
- reirob 12y agoThanks. But it omits the step of how to uninstalling the service, that is still running when following all the steps. Maybe it is something just limited to the Yoga 2?
- maxerickson 12y agoDid you do "Step 7. Restart your device"? I don't have a real clear idea of it, but I think many uninstallers are lazy about removing running services. So it might have been necessary there to complete the removal.