Microsoft's malware detection data shows that Lenovo's crapware has been scr믭 from about 250K Windows PCs Credit: Thinkstock Microsoft earlier this week said that search-and-destroy work by it, Lenovo and other software makers has reduced the daily number of Lenovo PCs found infected with the Superfish adware to below 1,000.In a blog post announcing the addition of another Superfish clean-up tool, Microsoft’s security team said that the number of infected PCs detected by its software peaked at around 60,000 on Feb. 21, slumped slightly over the next two days before falling precipitously. By Feb. 25, the daily number of infected PCs encountered by Microsoft’s tools had dropped to around 3,000, sliding further over the next several days to what appeared to be less than 1,000 each day.All told, Microsoft implied that about a quarter of a million Lenovo PCs were cleansed of Superfish between Feb. 20 and March 4.Microsoft’s numbers came from its Malicious Software Removal Tool (MSRT), a free utility pushed to Windows PCs monthly via Windows Update. MSRT, a companion to real-time security software like antivirus programs, includes a smaller set of “fingerprints” that detect and delete malware that Microsoft believes is the most pervasive or threatening. The company added a fingerprint for Superfish Visual Discovery, an ad-injection program pre-loaded on Lenovo’s consumer PCs for several months late last year, and according to reports, still contained on the Chinese PC maker’s machines that remain in the sales channel.To implant ads on encrypted websites, Superfish installed a self-signed root certificate into the Windows certificate store, then re-signed all certificates presented by domains using HTTPS. That meant a browser trusted all the fake certificates generated by Superfish, which was effectively conducting a classic “man-in-the-middle” (MITM) attack able to spy on supposedly secure traffic between a browser and a server. Once hackers cracked the encryption key for the Superfish certificate — a laughably easy job, as it turned out — they could launch their own MITM attacks by duping Lenovo PC users into connecting to a malicious Wi-Fi hotspot in a public place, like a coffee shop, airport or school campus.Lenovo published instructions for manually removing Superfish and its certificate, then followed that on Feb. 21 with an automated tool. Between Lenovo’s two moves, Microsoft updated its free Windows Defender and Security Essentials antivirus programs with a signature that sniffed out and deleted the rogue certificate.While it’s impossible to tell the impact of a specific tool — whether Lenovo’s, Microsoft’s or others’ — on the Superfish infection numbers, the cumulative effort did suppress the adware.Microsoft acknowledged that other software besides Superfish used the same security-threatening tactic, but said its tools only targeted Lenovo PCs. Related content feature Top cybersecurity M&A deals for 2023 Fears of recession, rising interest rates, mass tech layoffs, and conservative spending trends are likely to make dealmakers cautious, but an ever-increasing need to defend against bigger and faster attacks will likely keep M&A activity steady in By CSO Staff Sep 22, 2023 24 mins Mergers and Acquisitions Mergers and Acquisitions Mergers and Acquisitions brandpost Unmasking ransomware threat clusters: Why it matters to defenders Similar patterns of behavior among ransomware treat groups can help security teams better understand and prepare for attacks By Joan Goodchild Sep 21, 2023 3 mins Cybercrime news analysis China’s offensive cyber operations support “soft power” agenda in Africa Researchers track Chinese cyber espionage intrusions targeting African industrial sectors. By Michael Hill Sep 21, 2023 5 mins Advanced Persistent Threats Cyberattacks Critical Infrastructure brandpost Proactive OT security requires visibility + prevention You cannot protect your operation by simply watching and waiting. It is essential to have a defense-in-depth approach. By Austen Byers Sep 21, 2023 4 mins Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe