Superfish is a notorious piece of adware that was preinstalled on some Lenovo consumer laptops manufactured and sold around 2014–2015. Although it was designed to provide visual shopping recommendations, its implementation created a serious security problem by installing a trusted root certificate and intercepting encrypted HTTPS traffic.
The good news is that Superfish is no longer actively distributed, and affected systems can be cleaned. However, simply uninstalling the application is not enough. The Superfish certificate may remain in the Windows certificate store or in browsers such as Firefox.
This guide explains how to identify, uninstall, and completely remove Superfish and its associated certificate.
Important: Superfish is a historical Lenovo software issue, not a typical modern malware infection. The cleanup steps below are primarily relevant to older Lenovo PCs that may still contain the software or its certificate.
What Is Superfish?
Superfish was an advertising and visual-discovery program developed by Superfish Inc. and customized as VisualDiscovery for Lenovo laptops.
Lenovo preinstalled VisualDiscovery on certain consumer notebooks shipped beginning in September 2014. Lenovo stopped preloading it in early 2015 after security concerns were discovered. (Lenovo Support)
The major problem wasn’t simply the advertisements. VisualDiscovery installed a Superfish root certificate that allowed it to intercept HTTPS connections. This effectively placed the software between the browser and websites, potentially exposing sensitive information transmitted over encrypted connections. (FTC Search)
The U.S. Federal Trade Commission later described the software as creating serious security risks for affected consumers. (Federal Trade Commission)
Why You Should Remove Superfish Completely
Removing only the VisualDiscovery application can leave its trusted certificate behind.
That matters because the certificate was responsible for allowing Superfish to intercept encrypted connections. Lenovo’s own removal instructions specifically state that complete removal requires both the Superfish application and its certificate to be removed. (Lenovo Support)
Therefore, if you discover Superfish on an old Lenovo computer, don’t stop after uninstalling the program.
Step 1: Check Whether Superfish Is Installed
First, check your installed applications.
Windows 11 and Windows 10
- Press Windows + I to open Settings.
- Select Apps.
- Open Installed apps or Apps & features, depending on your Windows version.
- Search for:
- Superfish
- Superfish Inc. VisualDiscovery
- VisualDiscovery
- If you find the application, select it and choose Uninstall.
On older versions of Windows, you can instead open Control Panel → Programs → Programs and Features.
Look specifically for Superfish Inc. VisualDiscovery. Lenovo’s official instructions identify this as the application that should be uninstalled. (Lenovo Support)
Step 2: Remove the Superfish Certificate From Windows
This is the most important part of the cleanup.
Even after uninstalling VisualDiscovery, the certificate may remain in Windows.
Open the Certificate Manager
- Press Windows + R.
- Type:
certmgr.msc- Press Enter.
Alternatively, on supported Windows versions, search for Manage computer certificates and open it with administrator privileges.
Find the Superfish Certificate
Look under:
Trusted Root Certification Authorities → Certificates
Search for an entry associated with:
Superfish, Inc.
If you find it and have confirmed that it is the Superfish certificate, right-click it and select Delete.
Windows will ask you to confirm the removal.
Be careful: Do not delete unrelated root certificates. Removing legitimate certificates can cause websites, applications, or Windows services to stop trusting valid connections.
Lenovo’s documented manual procedure specifically instructs users to remove the Superfish, Inc. certificate from the trusted root certificate store. (Lenovo Support)
Step 3: Check Firefox Separately
Firefox has historically maintained its own certificate store rather than relying entirely on the Windows certificate store.
If Firefox is installed on an affected computer, check its certificate authorities as well.
Depending on the Firefox version, open:
Settings → Privacy & Security → Certificates → View Certificates
Then select the Authorities section and look for a certificate associated with Superfish, Inc.
If you find the confirmed Superfish certificate, remove or distrust it.
Lenovo specifically notes that Firefox and Thunderbird may require separate certificate removal. (Lenovo Support)
Step 4: Check Thunderbird If Installed
If you use Mozilla Thunderbird on an old affected system, check its certificate authorities too.
The certificate can be stored separately from the Windows certificate store, so removing it from Windows doesn’t necessarily remove every browser or application copy.
Lenovo’s removal instructions recommend repeating the certificate-removal process separately for Firefox and Thunderbird, including for each user on a multi-user computer. (Lenovo Support)
Step 5: Restart Your Computer
After uninstalling VisualDiscovery and removing the certificate, restart Windows.
A reboot ensures that:
- The old Superfish process is no longer running.
- Certificate changes are fully recognized.
- Browser and networking components reload.
- Any remaining active Superfish components are no longer operating.
Step 6: Run a Security Scan
After removing Superfish, perform a full scan using your current, reputable antivirus or antimalware software.
Make sure the security software is updated before starting the scan.
You don’t necessarily need to install several antivirus programs. Running multiple real-time security products simultaneously can create conflicts and unnecessary system overhead.
A full scan is useful because it can identify other unwanted software that may have been installed independently of Superfish.
Step 7: Check Your Browsers
After cleanup, open your regular browsers and verify that:
- HTTPS websites load normally.
- You aren’t seeing unexpected shopping advertisements.
- Browser security warnings aren’t appearing unexpectedly.
- No unknown extensions have been installed.
- Your browser homepage and search engine haven’t been changed.
If an old browser behaves strangely after removing Superfish, updating it—or replacing an obsolete browser with a currently supported version—is generally preferable to continuing to use outdated software.
Step 8: Update Windows and Your Software
If you’re working on an old Lenovo computer that still contains Superfish, there’s a good chance other software is outdated as well.
After completing the cleanup:
- Install available Windows updates.
- Update your web browser.
- Update your antivirus or security software.
- Update commonly used applications.
- Remove software you no longer need.
- Restart the PC after major updates.
Keeping the operating system and applications current is especially important on older machines.
Lenovo’s Official Superfish Removal Tool
Lenovo previously provided an automated Superfish Removal Tool designed to remove the application and associated certificates. Lenovo’s support documentation states that the tool was intended to provide complete removal, including certificates used by major browsers. (Lenovo Support)
For an old Lenovo system, use Lenovo’s official documentation rather than downloading a similarly named removal utility from an unknown third-party website.
Lenovo Superfish Uninstall Instructions
The official documentation also provides manual removal instructions if you don’t want to use the automated tool.
How to Tell If Superfish Is Still Present
You should investigate further if you find any of the following:
- Superfish Inc. VisualDiscovery in installed applications
- A Superfish, Inc. root certificate
- Unexpected VisualDiscovery-related files
- Superfish-related browser certificate entries
- Security software repeatedly detecting Superfish
- Unexpected advertisements associated with VisualDiscovery
However, don’t assume that every detection means the active Superfish program is still installed.
Some antivirus products may continue to report remnants after the main application has been removed. Lenovo also notes that benign files or registry entries can remain after manual removal, while its removal tool was designed to clean those remnants. (Lenovo Support)
What If Superfish Isn’t Listed in Installed Programs?
Don’t assume you’re completely safe just because VisualDiscovery isn’t listed.
The application may already have been removed while the certificate remains.
Check the Trusted Root Certification Authorities store and, where applicable, Firefox and Thunderbird’s certificate stores.
This is one of the most important differences between removing Superfish and uninstalling an ordinary application.
Should You Reset or Reinstall Windows?
Usually, you don’t need to reinstall Windows solely because Superfish was found.
If you can successfully remove:
- VisualDiscovery,
- the Superfish root certificate,
- browser-specific copies of the certificate,
and a reputable security scan finds no additional threats, a complete Windows reinstall is generally unnecessary just for this historical issue.
However, a clean Windows installation can be reasonable if the computer has additional malware, has been compromised in other ways, or you want to start over with a known-clean system.
Should You Change Your Passwords?
If Superfish was active on your computer while you were using sensitive online services, changing important passwords can be a sensible precaution—particularly if the machine was affected by the vulnerable version of VisualDiscovery.
Prioritize accounts such as:
- Banking
- Payment services
- Cloud storage
- Social media
- Work accounts
When possible, change passwords from a different trusted device and enable two-factor authentication.
The FTC noted that the vulnerable implementation could expose sensitive information transmitted over affected connections. (Federal Trade Commission)
Superfish Removal Checklist
Use this checklist to make sure you’ve completed the cleanup:
- Check installed programs for Superfish/VisualDiscovery
- Uninstall Superfish Inc. VisualDiscovery
- Open the Windows certificate store
- Remove the confirmed Superfish, Inc. certificate
- Check Firefox’s certificate authorities
- Check Thunderbird if installed
- Restart Windows
- Run a full antivirus/antimalware scan
- Update Windows
- Update your browsers
- Check browser extensions
- Consider changing important passwords if the vulnerable software was active
- Enable two-factor authentication on important accounts
Final Thoughts
Superfish is a particularly important example of why uninstalling unwanted software isn’t always enough. The VisualDiscovery application created a security problem because it installed a trusted root certificate that could interfere with encrypted HTTPS connections.
For affected Lenovo computers, the safest approach is to remove both the Superfish application and its trusted certificate. Lenovo’s official documentation confirms that certificate removal is an essential part of complete cleanup. (Lenovo Support)
If you are maintaining an older Lenovo laptop today, it’s also worth looking beyond Superfish. Update the operating system, browser, antivirus software, and other applications, and consider whether the computer is still receiving security updates. A properly updated system is far safer than simply removing one historical threat.
