It has been a rough couple of weeks for Lenovo since revelations surfaced that the PC maker was selling notebooks pre-installed with dangerous, HTTPS-breaking adware. Initially, the company said the Superfish ad-injector posed no threat, a position it quickly reversed. Then, company officials issued a mea culpa that said the company stopped bundling the software in December. For customers who remained vulnerable, executives promised to release a removal tool that would delete all code and data associated with the adware.

Based on the experience of Ars readers Chai Trakulthai and Laura Buddine, Lenovo overstated both assurances. The pair recently examined a $550 Lenovo G510 notebook purchased by a neighbor, and their experience wasn't consistent with two of Lenovo's talking points. First, the PC was ordered in early February more than four weeks after Lenovo said it stopped bundling Superfish, and yet when the notebook arrived in late February it came pre-installed with the adware and the secure sockets layer certificate that poses such a threat.

"Lenovo may be saying they haven't installed Superfish since December, but the problem is that they are still shipping out systems with Superfish installed," Buddine said. "The Windows build had a date of December. They apparently aren't sorry enough to re-image the computers they have in stock to remove the problem and they're still shipping new computers with Superfish installed."

With the discovery the PC was vulnerable, Trakulthai downloaded and ran Lenovo's official Superfish removal tool, which the PC maker states will "ensure complete removal of Superfish and certificates for all major browsers." But as images Trakulthai provided will attest, that too was an exaggeration. While the tool removed the dangerous certificate—and as a result closed the serious man-in-the-middle vulnerability it posed—Lenovo's software didn't begin to live up to its promise of removing all Superfish-related data. Based on its own self-generated report, the tool left behind the Superfish application itself. A scan using the Malwarebytes antivirus program found the Superfish remnants VisualDiscovery.exe, SuperfishCert.dll, and a VisualDiscovery registry setting.

"Even if the certificate was removed, I would think it rather dodgy that these files are still present," Martijn Grooten, a security researcher for Virus Bulletin, told Ars. "There’s no good reason why someone should have [them], and people would be right to be concerned." Grooten pointed out that in the past day, the source code for Lenovo's removal tool has been updated to fix some flaws.

"Skimming through it, the changes suggest that there were some scenarios that didn’t work perfectly," Grooten added. "This might be the case the reader ran into."

A Lenovo spokesman wrote in an e-mail to Ars: "If an individual customer has a specific question about their experience with the removal tool, they should contact the Lenovo Service line directly."

Customers should keep the above limitations in mind when parsing Lenovo's statements related to Superfish. They may find it more productive to follow manual instructions for removing the software or to follow Trakulthai and Buddine's lead and use Malwarebytes or another antivirus program to fully purge the nuisance.