How can I find and remove Superfish and similar malware?

When I started working abroad about three months ago, my company provided me with a new Lenovo laptop. Should I be worried? Anthony

Everyone should be worried, but not for the obvious reason.

The good news is that you probably do not have Superfish installed, and if you did, your anti-virus software may already have removed it: Microsoft released removal code in Windows Defender within about 24 hours of the news.

The bad news is that the “magic ingredient” in Superfish was an “SSL hijacker” and a root certificate provided by Komodia. This has been used by many other programs, including ones designed to provide parental controls. Worse, several other companies are trying the same idea.

You should therefore check to see if you have Superfish or any other untrustworthy certificates installed.

The Lenovo problem

The furore blew up because Lenovo installed Superfish adware on consumer laptops sold between September 2014 and January 2015. All these laptops were running Microsoft Windows 8.1. Your laptop fits the time frame, but you may have escaped for two reasons.

First, Superfish was not installed on Lenovo’s business machines, such as ThinkPads. Second, it was not installed on laptops running Windows 7, which is still the business standard.

Unfortunately, Lenovo’s attractive Yoga laptops – including the Yoga Pro models – are classed as consumer laptops. This may have caught some who wanted a smaller screen and/or cheaper device than the ThinkPad Carbon X1. Either way, Lenovo has listed the models that may have been affected in its security advisory.

Lenovo says “user feedback was not positive” so it disabled Superfish in January, and stopped preloading it.

On its Superfish uninstall web page, Lenovo has now provided an automatic removal tool (including source code) and illustrated manual instructions for removing Superfish and its certificate from laptops running Windows 8.1.

Removal is extremely simple via Windows’ standard add/remove programs utility, which most people know from the control panel. Find Superfish Inc VisualDiscovery, tick it, and click uninstall.

As mentioned, Superfish may already have been removed by Windows Defender, McAfee’s anti-virus software, and possibly by similar programs. However, with every version of Windows, you should still check that the certificate has been removed from your PC, and from Firefox’s certificate store. Why? There’s more …

The Komodia problem

As you will have gathered, Superfish on its own was no big deal. The problem was that Superfish used an “SSL hijacker” – Komodia Redirector with SSL Digestor – bought from a small Israeli company called Komodia. This opened a very large security hole. In fact, your PC may have this security hole even if it is not made by Lenovo and has never been near Superfish, because Komodia sold its kit to other companies as well.

These companies include Atom Security, Infoweise, Komodia (KeepMyFamilySecure), Kurupira (Webfilter), Lavasoft (Ad-Aware Web Companion), Qustodio, and Websecure Ltd (Easy Hide IP Classic), according to the official US vulnerability note.

Facebook adds: “We’ve observed more than a dozen other software applications using the Komodia library.” Its report names the certificate providers: CartCrunch Israel, WiredTools, Say Media Group, Over the Rainbow Tech, System Alert, ArcadeGiant, Objectify Media Inc, Catalytix Web Services and OptimizerMonitor. There will be others as well.

You probably do not think any of these have been installed on your PC. That is exactly what Lenovo laptop owners thought until last week.

Go to the Superfish, Komodia, PrivDog vulnerability test web page, and it will try to find any SSL-disabling software on your PC. The site was built and is being updated by Filippo Valsorda, who created the Heartbleed test site last year. (Heartbleed was a very serious vulnerability in the OpenSSL cryptographic software library.)

The certificate problem

We always advise people to use secure https:// websites, where traffic is protected using SSL (Secure Sockets Layer) encryption. This is particularly important for banking transactions and online shopping. Komodia’s SSL Digestor provided a way to subvert SSL to insert advertisements, and included its own certificate.

Briefly, a secure web server sends your browser its certificate and its public encryption key, so your browser can check that the certificate was issued by a trusted party. The certificate provides information about its owner, possibly including their name, email address and website address, and the identity of the certificate supplier – essentially a signature.

If the certificate is accepted, your browser and the website can use encrypted communications both ways. If the certificate is not accepted, the user gets a message to that effect – you have probably seen examples.

What Komodia did was interpose its own certificate without alerting the user. Worse, each product seems to have used the same certificate, and so far, it seems the password is always Komodia. As a result, many people – and almost any malware writer – could use this certificate to exploit your PC.

Uninstalling Superfish and other Komodia-type programs does not remove the root certificates, so you need to do this separately. Lenovo provides instructions, mentioned above. However, the quick way to do so is typing certmgr.msc into the Windows search box, right click on the program’s name, and select “run as administrator” from the pop-up menu.

When the certification manager program runs, click the action menu item and select “find certificates”. Type Superfish (etc) into the search box and click the “find now” button. If you find an unwanted certificate, right-click and select delete.

But wait: it gets worse….

Komodia is a problem, but it is far from the only company doing so. A post at How-To Geek says that adware programs such as Wajam, Geniusbox and Content Explorer are “all doing the exact same thing, installing their own certificates and forcing all your browsing (including https encrypted browsing sessions) to go through their proxy server”.

If you have installed software from unsafe places such as CNet’s Download.com or from Google search ads, you could have installed one of these without knowing it. How-To Geek suggests deleting certificates from Sendori, Purelead, Rocket Tab, Superfish, Lookthisup, Pando, Wajam, WajaNEnhance, System Alerts, and CE_UmbrellaCert. Given the number of certificates on the average PC, weeding out any bad ones will not be fun.

As How-To Geek points out, Microsoft has a web page that, at the click of a FixIt button, will delete “the certificates folder and everything inside it” and update it to “the list that is accepted by Microsoft as part of the Windows root certificate program”. This sounds like a good solution. But, it adds, “we really don’t recommend it until somebody tests this out”. Let me know if you do.

I reckon there is now a market for good certificate-checking software.

Have you got a question? Email it to Ask.Jack@theguardian.com