Questionable Extensions

[Grand Maester]

I have two components in Firefox 3 whose origin is not clear to me. One is the Microsoft .Net Framework Assistant v1.1 extension. The other is a plug-in for Window's Genuine Advantage.

Now as many of you are probably aware, plug-ins, unlike extensions, cannot be removed, only disabled. What I can't figure out is how I ended up with a Microsoft plug-in in a third party browser. As far as I can tell, plug-ins are pre-installed with the program, which means it would have to have been put there by Mozilla and I'm a little confused as to why they would agree to do that.

As for the .Net Framework Extension: I do have the framework installed; but wouldn't Firefox, the .Net installer or both have told me that it was installing an extension? Also is there a reason why I even need it?

**See Addendum in Post #7**

Edited June 27, 2009 by Grand Maester

[zhangm Supervisor]

The process that installed them was probably running with admin privileges, so I'm guessing that they installed either in the Firefox program folder, or you can remove them when Firefox is running as administrator.

[hdood]

I have two components in Firefox 3 whose origin is not clear to me. One is the Microsoft .Net Framework Assistant v1.1 extension. The other is a plug-in for Window's Genuine Advantage.

.NET and WGA are integral Windows components now, and it is just assumed that you want to be able to use them with whatever browsers you have installed. The plugin/extension lets you run .NET programs in the browser and report your .NET version to websites. Previously this functionality was limited to IE, but Microsoft has (had to) make it available to everyone. This is the same reason they also make a Windows Media Player plugin for Firefox.

[Grand Maester]

.NET and WGA are integral Windows components now, and it is just assumed that you want to be able to use them with whatever browsers you have installed. The plugin/extension lets you run .NET programs in the browser and report your .NET version to websites. Previously this functionality was limited to IE, but Microsoft has (had to) make it available to everyone. This is the same reason they also make a Windows Media Player plugin for Firefox.

First, why would websites need to know my .net version? Do I need to have the extension enabled or even installed at all?

Second, I don't see how WGA is an integral part of Windows. Unless other things have been added to it, my understanding is it's simply an anti-piracy tool. I don't like WGA because from what I've read, it collects way more information than is necessary to simply verify that a computer has a valid installation, which renders it akin to spyware. At any rate, will it cause me problems if I turn it off? I don't think that would be illegal since there's a button on the panel that allows you to do it.

[hdood]

The version stuff is just to make it easier for sites to offer you the correct download or online application, similarily to how visiting the Adobe site with Firefox will give you a Firefox plugin, while going there with IE will get you an IE plugin. It's not so much that you need it, it's that Microsoft has to offer the same functionality across browsers. You can safely disable it if you want.

As for WGA, it is required to download a lot of files from Microsoft (mostly "value added" stuff for Windows), and so again, Microsoft has to offer it for other browers than IE as well. It doesn't collect any information, it simply verifies the authenticity of your installation and tells the Microsoft server about it so you can download things. You don't really need it either.

You should ask yourself though, if you are so paranoid about these plugins (even going so far as to class it as spyware), should you really be running Windows at all? I mean, you're already trusting all your data to a Microsoft product.

[primexx]

firefox doesn't come with them. the .net plugin is installed along with .net and the only way i know that the wga plugin is installed is if you manually install it when downloading something from microsoft. it's possible that something else automatically downloads it though.

[Grand Maester]

firefox doesn't come with them. the .net plugin is installed along with .net and the only way i know that the wga plugin is installed is if you manually install it when downloading something from microsoft. it's possible that something else automatically downloads it though.

The .net item is an extension not a plugin (at least not in the way Firefox uses the term which isn't in the traditional sense because near as I can tell they are built in). However the WGA item is a plugin, and in Firedox plugins unlike extensions, don't appear to be able to be uninstalled, only disabled. If that is the case, how can Mozilla possibly justify allowing plugins to be installed by third-parties after the fact? It seems to me that if something isn't built into a program to begin with you should be able to remove it, whether it be an extension or plugin in Firefox or a patch to Windows (granted a few windows patches aren't removable but most are).

After looking at it again I've noticed most of the other plugins I have don't seem neccessary either:

• Google Gadget Plugin: I don't use Google gadgets.
  
• iTunes Application Detector: iTunes has a built-in browser so I've never used Firefox for any purpose related to it.
  
• Microsoft Office 2003 - Office Plugin for Netscape Navigator: I do have Office 2003 but I don't have Netscape Navigator and even if I did why would Firefox need a plugin for it?
  
• Microsoft DRM (Actually there's two of these: DRM Netscape Network Object and DRM Store Netscape Plugin): I've never used anything related to DRM or Netscape.
  
• Office Genuine Advantage: I've never heard of this but I'm assuming it's like WGA. So again, I don't see why I need it, particularly given that both Windows and Office Update won't work using the Mozilla rendering engine (Gecko I think it's called), and only occasionally works using the IEtab extension set to the IE rendering engine (Trident I believe). Usually I have to use IE itself so why do I need anything related to Office anti-piracy verification?
  

There's also three plugins which I have little if any idea as to their function:

• MetaStream 3 Plugin
  
• Window's Media Player Plug-in Dynamic Link Library - Npdsplay dll: To be honest, I've never fully understood what a Dynamic Link Library (DLL) is but I always thought it was part of the operating system not something that had anything to do with web browsers and I've heard of a number of dll exploits over the years so it makes a little nervous that I've got one sitting in the plugins panel.
  
• Windows Presentation Foundation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
  

And then there's the Yahoo Application State Plugin which Firefox says is "disabled for your protection". I have no idea what its purpose is supposed to be, but the bigger question is: Why can't I remove it if it's automatically disabled anyway?

I know this is pretty sweeping but clarification on these would be appreciated because if nothing else I'd like to disable as many of them as possible and even remove some of them if there's a way to and I'm sure it won't cause problems.

[+Gary7 Subscriber²]

There is a way to remove them but they are not doing any harm.

[night_stalker_z]

The .NET extension is most likely installed so all users have it which is why it cannot be removed. See here for some details about how it got on your machine: http://voices.washingtonpost.com/securityf...etly_insta.html

The others are probably installed by the apps although most probably don't give you the option to remove it.

The Netscape stuff is there because Firefox uses NPAPI for plugins: http://en.wikipedia.org/wiki/NPAPI

[primexx]

yea the idea is that the app which installed the plugin would provide the uninstaller too, which doesn't always happen.

[Grand Maester]

The .NET extension is most likely installed so all users have it which is why it cannot be removed. See here for some details about how it got on your machine: http://voices.washingtonpost.com/securityf...etly_insta.html

The others are probably installed by the apps although most probably don't give you the option to remove it.

The Netscape stuff is there because Firefox uses NPAPI for plugins: http://en.wikipedia.org/wiki/NPAPI

While the Washington Post article was helpful, it was incorrect (at least for me) when it stated that the uninstall button for the .NET framework extension is disabled, mine isn't. I think I asked this before, but do I really need it? The article never specifically addressed that, only saying that it wasn't a security threat.

The Wikipedia article was also helpful but it didn't specifically refer to the plugins so I still don't know if they are needed, that seems to be an important questions given that the article also said that NPAPI plugins can be just as unsecure as Active-X.

Does anybody know which plugins come pre-installed?

yea the idea is that the app which installed the plugin would provide the uninstaller too, which doesn't always happen.

You're saying that there is no way to remove plugins? Might it be possible by going into about:config (I think that's Firefox's term for its internal registry)? What if I uninstall Firefox and reinstall it? Will those applications automatically reinstall the plugins? Why don't uninstallers remove them? Above all else why would Mozilla add this whole new class of add-ons that can't be removed? They could have accomplished the same thing through extensions with the uninstall button disabled (although I don't like that either unless the extension is critical to an installed program and is removed when/if that program is uninstalled). It seems to me that this kind of sneaky cloak-and-dagger stuff is totally counter to the whole open source premise on which Firefox is based. People gravitate to this type of software because they don't want to deal with companies like Microsoft telling them what they have to install on their computers.

Can I get around this problem by using a program like Revo Uninstaller that follows up the built-in uninstall with a sweep of the registry for related keys and a scan of the hard drive for left over files?

What about the Yahoo plugin? Why is it still there if it's harmful?

Does anybody know a good reference source for determining what the different plugins are for?

Edited June 28, 2009 by Grand Maester

[i_was_here]

Does anybody know which plugins come pre-installed?

Afaik only one: Default Plugin (For Windows its npnul32.dll)

You're saying that there is no way to remove plugins?

If you want to remove a plugin you have to uninstall the program that installed it in the first place.

Some plugins like Flash are standalone and can be uninstalled from "Add or Remove Programs" (2000/XP/2k3) or "Programs and Features" (Vista/7)

[primexx]

While the Washington Post article was helpful, it was incorrect (at least for me) when it stated that the uninstall button for the .NET framework extension is disabled, mine isn't. I think I asked this before, but do I really need it? The article never specifically addressed that, only saying that it wasn't a security threat.

The Wikipedia article was also helpful but it didn't specifically refer to the plugins so I still don't know if they are needed, that seems to be an important questions given that the article also said that NPAPI plugins can be just as unsecure as Active-X.

Does anybody know which plugins come pre-installed?

You're saying that there is no way to remove plugins? Might it be possible by going into about:config (I think that's Firefox's term for its internal registry)? What if I uninstall Firefox and reinstall it? Will those applications automatically reinstall the plugins? Why don't uninstallers remove them? Above all else why would Mozilla add this whole new class of add-ons that can't be removed? They could have accomplished the same thing through extensions with the uninstall button disabled (although I don't like that either unless the extension is critical to an installed program and is removed when/if that program is uninstalled). It seems to me that this kind of sneaky cloak-and-dagger stuff is totally counter to the whole open source premise on which Firefox is based. People gravitate to this type of software because they don't want to deal with companies like Microsoft telling them what they have to install on their computers.

Can I get around this problem by using a program like Revo Uninstaller that follows up the built-in uninstall with a sweep of the registry for related keys and a scan of the hard drive for left over files?

What about the Yahoo plugin? Why is it still there if it's harmful?

Does anybody know a good reference source for determining what the different plugins are for?

you can manually remove the plugins by going and manually deleting their dll files if it doesn't show up as an option in either add/remove or the app's options panel. it's not really worth the effort though since disabling it makes it totally not run and aside from the entry in the addons list, it's no different than having been completely removed.

afaik the "plugins" system exists in every browser, for things like flash and shockwave to support media types and others to do other not-as-necessary things.

even addons are not all uninstallable through the gui so it's moot whether they install a plugin or global addon, just disable it or track down the actual files and manually delete it if you really want to.

[Grand Maester]

...even addons are not all uninstallable through the gui so it's moot whether they install a plugin or global addon...

Foregive my ignorance, but I'm not following on this part, could you please explain what you mean a little further?

[primexx]

Foregive my ignorance, but I'm not following on this part, could you please explain what you mean a little further?

i don't remember all the technical details but some programs could install "global" addons where the files are located at an arbitrary location with a registry pointer to them. since it's installed outside firefox's scope (i.e. it might not necessarily be able to modify it) the application can't uninstall it within the addon manager, and you'll have to manually remove it. this is the case for the .net extension. then there's the normal addons which are installed (either by an app or by the user) into the profile directory, that is removable from the addon manager. there's also another unremovable (iirc) type which is installed in the firefox directory in program files, i'm not sure why this is but it's probably because it's profile independent, an example would be the java console addon.

[rover3500]

i just uninstalled the .net plugin,no probs.It had a button for it

[Grand Maester]

...there's also another unremovable (iirc) type which is installed in the firefox directory in program files, i'm not sure why this is but it's probably because it's profile independent, an example would be the java console addon.

What is iirc? What do you mean by "firefox directory in program files"

i just uninstalled the .net plugin,no probs.It had a button for it

The .net framework add-on isn't a plugin, it's an extension. My issue with uninstallation relates to plugins not extensions. My issue with extensions is whether they are safe to disable.

[night_stalker_z]

You can disable all plugins listed in post #7 safely maybe except from Window's Media Player Plug-in Dynamic Link Library as that allows you to play wmv/wma files. Most sites will tell you to install a plugin if it cannot detect it such as YouTube and Flash but you can usually enable the plugin and reload the page.

There's a plugins folder in the Firefox installation folder where plugins can be installed globally for all users.

[Grand Maester]

i don't remember all the technical details but some programs could install "global" addons where the files are located at an arbitrary location with a registry pointer to them. since it's installed outside firefox's scope (i.e. it might not necessarily be able to modify it) the application can't uninstall it within the addon manager, and you'll have to manually remove it. this is the case for the .net extension. then there's the normal addons which are installed (either by an app or by the user) into the profile directory, that is removable from the addon manager. there's also another unremovable (iirc) type which is installed in the firefox directory in program files, i'm not sure why this is but it's probably because it's profile independent, an example would be the java console addon.

Actually, that's not the case with the .net extension, it can be removed from the addon manager.

You can disable all plugins listed in post #7 safely maybe except from Window's Media Player Plug-in Dynamic Link Library as that allows you to play wmv/wma files. Most sites will tell you to install a plugin if it cannot detect it such as YouTube and Flash but you can usually enable the plugin and reload the page.

There's a plugins folder in the Firefox installation folder where plugins can be installed globally for all users.

If they're installed in the Firefox directory, it doesn't make any sense that they can't be removed using the addon manager. As some of you pointed out, they can be disabled, which has the same affect. I just don't like having a bunch of unnecessary addons cluttering up my addon manager.

One question that never got answered, what's "iirc"?

[AaronMT]

Hi All,

I am a member of Mozilla's internal QA team and we recently did some testing alongside Microsoft testing their .NET Framework Assistant and Firefox 3.5

The results of our testing can be seen here. Please seek out the subsection, 'Additional Resources' for information on applying the .NET Framework Assistant 1.1 patch. .NET Framework Assistant 1.1 enables the uninstall functionality.

Thanks,

Aaron (Mozilla QA)

[primexx]

What is iirc? What do you mean by "firefox directory in program files"

if i recall correctly

the firefox directory in program files is %programfiles%/Mozilla Firefox/ (the default, anyways)

Actually, that's not the case with the .net extension, it can be removed from the addon manager.

if you have mr.tech's toolkit or something you'll see that although it removes the extension from the addons window it doesn't completely "uninstall" it like you'd expect it to. you still have to manually delete it to get rid of it.

[Grand Maester]

if you have mr.tech's toolkit or something you'll see that although it removes the extension from the addons window it doesn't completely "uninstall" it like you'd expect it to. you still have to manually delete it to get rid of it.

How would I do that?

[primexx]

http://support.microsoft.com/kb/963707

[smooth_criminal1990]

have you downloaded anything from the download centre on the Microsoft website? If you downloaded something that needed "validation" it may have needed to install the WGA plugin to your browser to check your copy of Windows is legit. If it isn't, you just won't be allowed to download anything needing genuine validation from the Microsoft download centre.