Gilles Gravier's Weblog

Microsoft's unremovable add-on to Firefox

See, this is why I think we should all be extremely careful when it comes to using Microsoft software.

Recently, one of the Windows updates resulted in an add-on being, well, added, to Firefox. This happened with the Microsoft .NET Framework 3.5 Service Pack 1 update, pushed through the Windows Update service to all recent editions of Windows in February 2009.

First, I'm really upset that this didn't ask my permission to add the Firefox add-on. That alone is enough to break whatever confidence I had left in that company's way of dealing with user's property.

Second, when I realized what was going on, and that there was a significant security risk to that add-on, I decided to remove it. Unfortunately, Microsoft decided that I'm not supposed to remove that add-on. Maybe they think they know better than me. As a result, the add-on's uninstall button is greyed out. The only way I found to remove it was to follow the instructions on Annoyances.org.

Just to make sure this is really clear, I'll repeat those instructions here :

1. Open Registry Editor (type regedit in the Start menu Search box in Vista/Windows 7, or in XP's Run window).
2. Expand the branches to the following key:
   • On 32-bit systems: HKEY_LOCAL_MACHINE \ SOFTWARE \ Mozilla \ Firefox \ Extensions
   • On x64 systems: HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Mozilla \ Firefox \ Extensions
3. Delete the value named {20a82645-c095-46ed-80e3-08825760534b} from the right pane.
4. Close the Registry Editor when you're done.
5. Open a new Firefox window, and in the address bar, type about:config and press Enter.
6. Type microsoftdotnet in the Filter field to quickly find the general.useragent.extra.microsoftdotnet setting.
7. Right-click general.useragent.extra.microsoftdotnet and select Reset.
8. Quit Firefox (or else step 10 won't work)
   
9. Open Windows Explorer, and navigate to %SYSTEMDRIVE%\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation.
10. Delete the DotNetAssistantExtension folder entirely.
11. Restart Firefox
    
12. Open the Add-ons window in Firefox to confirm that the Microsoft .NET Framework Assistant extension has been removed.

Now repeat after me : "I don't trust Microsoft to want the best for my PC... ever. I am convinced that many more times in the future, they will resort to this kind of behavior and install code that poses a risk to my machine without asking me and making very sure I can't remove it easily".

If you have to use Microsoft software for specific tasks (I have to), be extremely careful with what they install on your machine without telling you.

If you want to be able to trust your machine, use an open source operating system such as OpenSolaris or one of the Linux variants (I like Ubuntu). But don't even start thinking you can trust Microsoft with your machine. They just proved to the world it's a trust incorrectly placed.

And while you're at it, ditch MS Office... go for OpenOffice.org. You're better off from a security perspective... and already all set to send and work with documents that all major governments are starting to define as their standard format.

Posted at 09:16PM Jun 08, 2009 by gravax in Security  |  Comments[0]