Network News

X My Profile
View More Activity

Microsoft's Fix for the Firefox Add-on Snafu

Last week, I received a tremendous reader response to a post I wrote about a security update from Microsoft that silently installed a "Microsoft .NET Framework Assistant" add-on for Firefox that was difficult and risky for users to uninstall. Given the emotional buttons this subject pushed among a large number of readers, I've put together a brief update along with some information provided in the comments to the previous post.

ffpatch1.jpg

Since that posting, someone pointed out that Microsoft has issued a patch in an apparent bid to appease those who have cried foul about this silently installed add-on. The patch is available and detailed at this link here. The update patches Windows systems so that the add-on installed by Microsoft can be successfully uninstalled without the user having to manually edit the Windows registry. (While editing the registry isn't all that difficult, a misstep can cause serious problems and it is a task Microsoft does not recommend lightly for the Average Joe PC user).

From the Microsoft advisory:

To properly update the .NET Framework Assistant, this update must be applied while the extension is enabled in Firefox. To remedy the result of installing this update while the extension was disabled, uninstall the update, re-enable the extension, and reinstall the update. Updates to the .NET Framework Assistant may include updates to the Windows Presentation Foundation Plug-in for Firefox causing it to be enabled upon its initial update.

So, in short, if you've chosen to merely click the "disable" button on this add-on instead of manually removing it by editing the Windows registry, you will need to re-enable the add-on before applying this fix.

After you've downloaded and installed the update, if you check Add-ons from the Firefox menu you'll notice that the .NET Framework Assistant add-on is now at version 0.0.0 (from 1.0), and that you are prompted to restart the browser (see below).

ffpatch2.jpg

Upon restart, check your Add-ons again and you'll see that the add-on has been reinstalled so that the uninstall tab is no longer grayed out. You still have to click the uninstall tab and "yes" to the "are you sure" prompt, and then restart Firefox again to fully banish the thing.

ffpatch3.jpg

The Service Pack 1 patch for .NET that originally installed this add-on also installs a Firefox plug-in called the "Windows Presentation Foundation plug-in for Mozilla browsers." If you had disabled that plug-in after installing the .NET Service Pack 1, note that installing this patch re-enables that plug-in.

ffpatch4.jpg

Interestingly, one reader forwarded me this link at Bugzilla -- Mozilla's bug tracking database. It's an inside look at debate among Firefox developers over whether the ability of third party applications to install their own add-ons and block users from easily uninstalling them should be considered a bug.

One final note, as Microsoft and a number of readers have noted, the uninstall button for the original .NET add-on that started all this is not grayed out for Windows 7 users, so those users can remove this add-on without going through all this.

By Brian Krebs  |  June 3, 2009; 9:30 AM ET
Categories:  From the Bunker , New Patches  | Tags: microsoft patch firefox add-on  
Save & Share:  Send E-mail   Facebook   Twitter   Digg   Yahoo Buzz   Del.icio.us   StumbleUpon   Technorati   Google Buzz   Previous: Security Updates for iTunes, QuickTime
Next: FTC Sues, Shuts Down N. Calif. Web Hosting Firm

Comments

Thanks for this fix! I have happily uninstalled the offending extension.

Now that you've gone this far, why not investigate the plugins that are likely to be quietly added to Firefox by common software. Do they provide any useful functionality? Are they secure? Here are the plugins I've got:

- 2007 Microsoft Office System (doesn't seem to let me open documents within Firefox--what's the use?)
- Adobe Acrobat
- iTunes Application Detector
- Java(TM) Platform SE 6 U13 (binary)
- Java(TM) Platform SE 6 U13 (DLL helper)
- Microsoft(r) DRM (Network Object)
- Microsoft(r) DRM (Plugin)
- Microsoft(r) Windows Media Player Firefox Plugin
- Mozilla Default Plug-in
- QuickTime Plug-in 7.6.2
- Shockwave Flash
- Shockwave for Director
- Windows Media Player Plug-in DLL
- Windows Presentation Foundation

Posted by: bokamba | June 3, 2009 11:07 AM | Report abuse

> It's an inside look at debate among Firefox developers

With all due respect, I think you misread it. There is no debate among Firefox developers, developers all agree that Firefox shouldn't remove registry keys that a different application installed or misbehave in a similar way. The guys arguing against are exclusively end users - which you see by the fact that their suggestions don't get more precise than "Uninstall button shouldn't be disabled". Also, disabling works just as well as uninstalling - again, end users might disagree here. Which is why the real discussion moved to https://bugzilla.mozilla.org/show_bug.cgi?id=476430

Posted by: WladimirPalant | June 3, 2009 11:12 AM | Report abuse

@Wladimir -- Point taken. "Developers" was probably a poor choice of words. It's still a fascinating discussion. Thanks for the link to the continuing thread.

Posted by: BTKrebs | June 3, 2009 11:15 AM | Report abuse

After reading your first article on the subject, and checking a few forums to see if Microsoft .NET Framework 3.5, 3, and 2 were really necessary for my computer life, I simply uninstalled them. Apparently they are not necessary for a simple email and web browsing person like me. That removed the Firefox extension as well. I retained v1.1 because it did not seem to be doing any harm.

I strongly object to any company making changes to my computer and its software without my permission. I don't want mysterious new Firefox extensions, nor do I want "secret" Microsoft updates, or any other changes.

Thank you so very much for noticing and reporting on all of these computer goings on.

Posted by: dreherd | June 3, 2009 12:35 PM | Report abuse

I am grateful to have the repair information, but more annoyed at Microsoft after looking at the page linked in the article. At first glance it looked like the link was to the wrong destination:

"Update to .NET Framework 3.5 SP1 for the .NET Framework Assistant 1.0 for Firefox is required to address several compatibility issues with the Firefox browser."

The issues are not 'with the Firefox browser.' A reader could easily misunderstand that Mozilla was partially or completely at fault for the problem. That may have been the actual intent.

[Also, there is a second update recommended near the end of the article, KB959209.]

Posted by: StormyWebber | June 3, 2009 3:08 PM | Report abuse

I have not seen this on my computer. I have .NET up tp 3.5 SP1 and cannot find this in any of my Firefox 3.0.10 profiles, extensions or plug-ins.

Windows XP SP3 is up to date. I manually update and use the Advanced mode instead of express and I haven't hidden any downloads to not be offered.

What am I missing?

Posted by: minotisok | June 3, 2009 5:00 PM | Report abuse

Thanks for the update Brian, this makes things a lot clearer. Much appreciated!

Posted by: IanET | June 3, 2009 6:03 PM | Report abuse

I've also got .NET through 3.5, but the issue apparently relates to a later service pack for it, which I haven't installed:

http://support.microsoft.com/kb/951847

There's obviously a "principle" involved in modifying Firefox, but since I do run some applications that require .NET and Firefox, e.g. FileHippo update manager for all my little XP applications, I'm not sure I actually don't want whatever the new functionality is. A fuller discussion of what the extension does should accompany all the outraged uninstall instructions.

Posted by: internet2k4 | June 3, 2009 8:29 PM | Report abuse

The Registry Hack went well and is not as difficult as it is being made out to be.

Posted by: brucerealtor@gmail.com | June 4, 2009 11:47 AM | Report abuse

Now if only Google Toolbar conflicts could get resolved ASAP for the most recent 3.0.10 download [not to even mention the 3.5 Beta download]

We all could have a meaningful spell check feature again.

HELLO GOOGLE -- HELLO FIREFOX
ANYONE HOME ????

Posted by: brucerealtor@gmail.com | June 4, 2009 11:50 AM | Report abuse

Brian, allow me once again to point out that the language of the Microsoft advisory can be misleading : «To properly update the .NET Framework Assistant, this update must be applied while the extension is enabled in Firefox.» My experience is that despite the assistant not being enabled in Firefox 3.5b4, as it is incompatible with that version, it can still be removed from the browser. Thus, all that those running Firefox 3.5b4 have to do is install the update to the add-on as per your (Microsoft's) instructions above, and then click «Tools» in the Firefox menu bar, select «Add-ons», scroll down to «.NET Framework Assistant», and click the «Uninstall» button. The assistant will then be removed after Firefox is restarted....

Henri

Posted by: mhenriday | June 4, 2009 11:57 AM | Report abuse

F.Y.I. Turbotax 2007 and Turbotax 2008 installs .NET Framework. If you uninstall Turbotax, .NET Framework remains behind. Last year, I only noticed it during a routine viewing of my Add/Remove Programs panel. I wondered where this 186 megabyte pig came from until I looked at the install date.

So far, Turbotax is the only mainstream app that I use that requires .NET. I now make it a point to uninstall .NET after tax season is over.

I haven't uninstalled Turbotax 2008 yet, so I did see this MS update present itself in April. Fortunately, my Automatic Updates is set to "Notify but do not download or install." Since the .NET service pack wasn't discussed in the April security bulletin and my .NET installation was on its way out, I ignored it.

If MS feels it is a security update, it should have been given its own section in the bulletin summary

Posted by: taskforceken | June 6, 2009 2:32 AM | Report abuse

The comments to this entry are closed.

 
 
RSS Feed
Subscribe to The Post

© 2010 The Washington Post Company