Microsoft updates Windows Defender, its onboard anti-virus software, to remove the Superfish software that was pre-installed on many Lenovo computers
While Lenovo Stumbles And Superfish Remains Silent Center for Democracy & Technology : Is Breaking Web Encryption Legal? Simon Phipps / InfoWorld : Lenovo: ‘We were as surprised as you’ — In an exclusive interview … Lucian Constantin / PC World : Superfish vulnerability traced to other apps, too Blair Hanley Frank / GeekWire : Microsoft updates Windows Defender to protect against problematic Lenovo adware Alex Hern / Guardian : Lenovo apologises for security-busting adware, offers ‘incomplete’ removal instructions Jim Finkle / Globe and Mail : U.S. government urges Lenovo customers to remove Superfish software Martin Brinkmann / gHacks Technology News : Microsoft, LastPass and others post solutions to handle Superfish Annalee Newitz / Gizmodo : Lenovo Joins the Malevolent Side of the Online Advertising Industry Andre Yoskowitz / AfterDawn.com : Lenovo releases a tool to uninstall adware program Superfish Brandon Russell / TechnoBuffalo : There's an easy way to remove Superfish from your Lenovo computer Steven Parker / TechSpot : Neowin: Microsoft updates Windows Defender, fries Superfish adware Kate Cox / Consumerist : Here's How To Get Rid Of That Nasty Superfish Vulnerability On Your New Lenovo Laptop Gohar Anwar / TechFrag : How to Remove Superfish Adware from Your Lenovo Laptop Brad Linder / Liliputing : How to tell if your Lenovo PC has Superfish, and what to do about it Charlesarthur / The Overspill : Start up: Lenovo, Superfish and its implications; identifying Jackson Pollocks, tech v fashion, and more David Auerbach / Slate : You Had One Job, Lenovo Tweets: Filippo Valsorda / @filosottile : Windows Defender version 1.193.444.0 will detect and remove Superfish AND the system cert http://pastebin.com/... pic.twitter.com/TqLMtiljuI @reuterstech : Dept of Homeland Security advises Lenovo customers to uninstall ‘superfish’ software, says makes PCs vulnerable to attack Russell Brandom / @russellbrandom : Microsoft's coming away as one of the heroes of the Superfish debacle. http://www.theverge.com/...
Context & Ripple Effects
Lenovo's week had already gone badly before Microsoft stepped in: its first response to the Superfish scandal was widely panned — Wired called the company's reaction 'astonishingly clueless' (Lenovo's initial response) — while Superfish itself doubled down, insisting its HTTPS-busting adware poses no security risk (Superfish doubles down) even as the Department of Homeland Security urged customers to uninstall it.
Against that backdrop, this update matters because Microsoft bypassed both parties entirely: rather than waiting for Lenovo to fix its own machines, the Windows owner turned its onboard antivirus into the cleanup mechanism. Lenovo did release an automatic Superfish removal tool of its own the next day, but Microsoft's move means remediation no longer depends on either the OEM or the adware vendor acting in good faith.
First-order effects
- Owners of affected Lenovo PCs get automatic removal of Superfish and its system certificate through Windows Defender whether or not they ever run Lenovo's own cleanup tool — the security hole starts closing at OS level, immediately.
- Lenovo loses control of the remediation narrative: its apology and removal instructions are now backstops, not the fix, while Superfish's public claim that the adware poses no security risk is directly contradicted by the world's largest desktop software maker treating it as malware.
Second-order effects
- Every Windows OEM now knows Microsoft will classify pre-installed partner software as malware when it undermines encryption — a pricing and vetting problem for any vendor whose business model depends on bundling third-party adware into consumer PCs.
- Security researchers who traced the Superfish certificate flaw to other applications (per the related coverage) gain a template: flag the issue publicly and the Defender pipeline can force removal across the whole ecosystem, not just one OEM's machines.
Third-order effects
- If Microsoft keeps using Defender as an enforcement layer over OEM software choices, the practical gatekeeper of what ships on a Windows PC shifts from the hardware maker to the platform owner — a structural rebalancing of the Wintel relationship.
- With DHS already advising consumers on the matter, the episode points toward pre-installed software becoming a regulatory and procurement concern for PC makers generally, not just a PR problem for whichever vendor gets caught next.
The trend: PC platform owners are asserting themselves as the last line of defense against OEM-bundled software, willing to strip partners' pre-installs at OS level when security demands it.