Comment by reirob | Hacker News Reader

Comment by reirob | Hacker News Reader

Parent Full thread

I just followed Lenovo’s instructions [0] to uninstall SuperFish on a friend’s computer (Lenovo Yoga 2, Win 8.1). These instructions are NOT sufficient. After uninstalling SuperFish through the normal windows uninstallation program, and the Root CA certs for IE and Firefox, suddenly none of the HTTPS sites worked! The browser complained (rightly), that the the certificate is wrong because it is signed by SuperFish.

I had to do some research to detect, that there is still a service called VisualDiscovery, which is activated on startup. Looking in the properties I can see that it starts “C:\Program Files (x86)\Lenovo\VisualDiscovery\VisualDiscovery.exe”. I stopped it and now it works as supposed. But I still have to find a way how to uninstall this stuff.

I’m a Linux guy, but I find it crazy, that after uninstalling VisualDiscovery/SuperFish there are still executables and a service remaining on the disk. This is crazy.

[0] http://support.lenovo.com/us/en/product_security/superfish_u...

(Apologies if the formatting is problematic, my first post).

1. Stop the service:

    sc stop VisualDiscovery

2. Open up your favourite process manager and remove any superfish processes (containing the word superrfish).

3. Perform the uninstall via Add/Remove Programs (under superfish)

4. Confirm %ProgramFiles%/Lenovo/VisualDiscovery is deleted.

5. Open System32 and confirm there are no files beginning with VisualDiscovery

6. Open AppData and confirm that no files start with VisualDiscovery

7. Remove certificates (Firefox and Global).

8. Remove from Registry: HKLM\SOFTWARE\Wow6432Node\VisualDiscovery.

After that, VisualDiscovery should be fully removed.

Thank you, I'll try this.

But why is it not in Lenovo's instructions? After following only their instructions, you are in a worse state than before, i.e. SuperFish still working, but without root CAs, browsers shouting (good so), and users panicking.

There's also these instructions from Ars Technica: http://arstechnica.com/security/2015/02/how-to-remove-the-su...

Thanks. But it omits the step of how to uninstalling the service, that is still running when following all the steps. Maybe it is something just limited to the Yoga 2?

Did you do "Step 7. Restart your device"?

I don't have a real clear idea of it, but I think many uninstallers are lazy about removing running services. So it might have been necessary there to complete the removal.

Reply on news.ycombinator.com