ClanKiller.com
https://forums.plasmasky.com/

Sneaky Microsoft Firefox Extension
https://forums.plasmasky.com/viewtopic.php?f=8&t=3047		 Page 1 of 1
Author:  Satis [ Mon Feb 02, 2009 7:53 am ]
Post subject:  Sneaky Microsoft Firefox Extension
Ok, so Microsoft slipped a Firefox extension in with some updates recently. Chances are you all have it if you run FF. Go to Tools -> AddOns and look for Microsoft .NET Framework Assistant. There? Yeap, thought so. Irritating. Among other things, it actually alters your browser identification string. Go Microsoft!

Of course, you can't remove it via the addons panel, you have to do it via the registry and deleting files off the hard drive. Go Microsoft! Here's some quick instructions, gotten via http://nambulous.wordpress.com/2008/08/ ... m-firefox/.

Launch the registry editor via start | run | regedit
go to HKEY_LOCAL_MACHINE/SOFTWARE/Mozilla/Firefox/Extensions
delete the value on the right, or just delete the whole extensions key if you want.

go to HKEY_LOCAL_MACHINE/SOFTWARE/MozillePlugins
delete the key @microsoft.com/WPF,version=3.5

on the hard drive, go to C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation
Delete everything in this folder

In Firefox, type about:config in the address bar and click ok on the warning.
In filter type microsoft.
find "general.useragent.extra.microsoftdotnet" and "microsoft.CLR.clickonce.autolaunch", right click on them and choose reset, then close and reopen Firefox

That should do it. The values should be gone from about:config and the add-on will be gone from the addons. Good times to be had by all!
Author:  Mole [ Mon Feb 02, 2009 12:11 pm ]
Post subject: 
Hmm, nothing in my add-ons list yet - but next time my PC get's any windows updates I'll be double checking.

What's it supposed to actually do?

Thanks for the H/U either way :D
Author:  Rinox [ Mon Feb 02, 2009 12:39 pm ]
Post subject: 
It's MS. It eats your babies. It also rapes puppies.
Author:  Satis [ Mon Feb 02, 2009 2:12 pm ]
Post subject: 
People are guessing it's setting the way for some new Microsoft web initiative. Maybe a new push for Silverlight or something, I don't know. The fact it installs on a non-Microsoft product without so much as a warning is inexcusable.

I'll probably write an app to automate removing this thing.
Author:  Satis [ Wed Feb 04, 2009 2:38 pm ]
Post subject: 
well, I was working on it but I'm kinda burned out at this point. Deleting the physical files is easy. I got removing one of the two reg keys automated...the second one is giving me permission denied errors for some reason. That's where I gave up.

I'm not sure how to edit the about:config values. I thought they'd be in user.js, but they're not. They may be in the sqlite db, but I don't really know.

Anyway, for now I'll just paste up my source code. If I ever finish it, I'll post the full project and binary.

You may ask why do I care so much? I don't. It's just good practice doing c# winform development. I'm still a noob.

the code:
Code:
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using Microsoft.Win32;
using System.Security;
using System.IO;

namespace cleanMSFirefoxAddon
{
    public partial class mainForm : Form
    {

        public mainForm()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            messages.Text = "Deleting registry entries\n";
            //remove registry entries
            string keybase = "SOFTWARE\\Mozilla\\Firefox";
            RegistryKey key = Registry.LocalMachine.OpenSubKey(keybase + "\\extensions");
            if (key == null)
            {
                //maybe 64bit Vista
                keybase = "SOFTWARE\\Wow6432Node\\Mozilla\\Firefox";
                key = Registry.LocalMachine.OpenSubKey(keybase + "\\extensions");
            }
            if (key != null)
            {
                clearRegistry(keybase, "extensions");
            }
            else
            {
                messages.Text += "     extensions key does not exist.\n";
            }
            keybase = "SOFTWARE\\MozillaPlugins";
            key = Registry.LocalMachine.OpenSubKey(keybase + "\\@microsoft.com/WPF,version=3.5");
            if (key == null)
            {
                //maybe 64bit Vista
                keybase = "SOFTWARE\\Wow6432Node\\MozillaPlugins";
                key = Registry.LocalMachine.OpenSubKey(keybase + "\\@microsoft.com/WPF,version=3.5");
            }
            if (key != null)
            {
                clearRegistry(keybase, "@microsoft.com/WPF,version=3.5");
            }
            else
            {
                messages.Text += "     @microsoft.com/WPF,version=3.5 key does not exist.";
            }

            //remove physical files
            if (!clearFiles())
            {
                messages.Text += "Deleting physical files failed, aborting.\n";
                return;
            }

            //make changes to about:config
            if (!resetConfig())
            {
                messages.Text += "Reseting about:config failed, aborting.\n";
                return;
            }

        }
        private void clearRegistry(string keybase, string extension)
        {
            RegistryKey key = Registry.LocalMachine.OpenSubKey(keybase);
            messages.Text += "     Attempting to delete " + keybase + "\\" + extension + "\n";
            try
            {
                key.DeleteSubKeyTree(extension);
                messages.Text += "    Deleted key " + key.Name + "\n";
            }
            catch (ArgumentException ex)
            {
                messages.Text += "     The key appears to no longer exist.  Since we tested for its existence, this is odd.  Aborting.\n     " +
                    ex.Message + "\n";
            }
            catch (SecurityException ex)
            {
                messages.Text += @"     You don't have permissions to delete the registry key.\n " +
                    "     Be sure you're running this application as an administrator.\n     " +
                    ex.Message + "\n";
            }
            catch (UnauthorizedAccessException ex)
            {
                messages.Text += "     You don't have permissions to delete the registry key.\n " +
                    "     Be sure you're running this application as an administrator.\n     " +
                    ex.Message + "\n";
            }
            catch (ObjectDisposedException ex)
            {
                messages.Text += @"     This exception should only occur if the registry key was deleted at the " +
                    "same time this delete request was made.  Aborting application run.\n     " + ex.Message + "\n";
            }
            catch (Exception ex)
            {
                messages.Text += @"     Uncaught exception, aborting: " + ex.Message + "\n";
            }
        }
        private bool clearFiles()
        {
            string path = Environment.GetEnvironmentVariable("WINDIR") + @"\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistanceExtension";
            if (Directory.Exists(path))
            {
                Directory.Delete(path, true);
                messages.Text += "Deleted files\n";
            }
            else
            {
                messages.Text += "Files do not exist\n";
            }
            return true;
        }
        private bool resetConfig()
        {
            /*
             *  not sure
             * 
             */
            return true;
        }

    }
}
Author:  Satis [ Thu Feb 05, 2009 2:11 pm ]
Post subject: 
yea, I know noone cares. :(

I found the bug with deleting the reg keys. Stupid mistake on my part, but they usually are. I also found one of the 3 about:config values but haven't coded the routines to remove it from the prefs file. So far this app *should* work for all versions of Windows to remove the reg files and physical files on the hard drive. About:config values still need to be altered manually.
Code:
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using Microsoft.Win32;
using System.Security;
using System.IO;

namespace cleanMSFirefoxAddon
{
    public partial class mainForm : Form
    {

        public mainForm()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            messages.Text = "Deleting registry entries\n";
            //remove registry entries
            string keybase = "SOFTWARE\\Mozilla\\Firefox";
            RegistryKey key = Registry.LocalMachine.OpenSubKey(keybase + "\\extensions");
            if (key == null)
            {
                //maybe 64bit Vista
                keybase = "SOFTWARE\\Wow6432Node\\Mozilla\\Firefox";
                key = Registry.LocalMachine.OpenSubKey(keybase + "\\extensions");
            }
            if (key != null)
            {
                clearRegistry(keybase, "extensions");
            }
            else
            {
                messages.Text += "     extensions key does not exist.\n";
            }
            keybase = "SOFTWARE\\MozillaPlugins";
            key = Registry.LocalMachine.OpenSubKey(keybase + "\\@microsoft.com/WPF,version=3.5");
            if (key == null)
            {
                //maybe 64bit Vista
                keybase = "SOFTWARE\\Wow6432Node\\MozillaPlugins";
                key = Registry.LocalMachine.OpenSubKey(keybase + "\\@microsoft.com/WPF,version=3.5");
            }
            if (key != null)
            {
                clearRegistry(keybase, "@microsoft.com/WPF,version=3.5");
            }
            else
            {
                messages.Text += "     @microsoft.com/WPF,version=3.5 key does not exist.";
            }

            //remove physical files
            if (!clearFiles())
            {
                messages.Text += "Deleting physical files failed, aborting.\n";
                return;
            }

            //make changes to about:config
            if (!resetConfig())
            {
                messages.Text += "Reseting about:config failed, aborting.\n";
                return;
            }

        }
        private void clearRegistry(string keybase, string extension)
        {
            RegistryKey key = Registry.LocalMachine.OpenSubKey(keybase, true);
            messages.Text += "     Attempting to delete " + keybase + "\\" + extension + "\n";
            try
            {
                key.DeleteSubKeyTree(extension);
                messages.Text += "    Deleted key " + key.Name + "\n";
            }
            catch (ArgumentException ex)
            {
                messages.Text += "     The key appears to no longer exist.  Since we tested for its existence, this is odd.  Aborting.\n     " +
                    ex.Message + "\n";
            }
            catch (SecurityException ex)
            {
                messages.Text += @"     You don't have permissions to delete the registry key.\n " +
                    "     Be sure you're running this application as an administrator.\n     " +
                    ex.Message + "\n";
            }
            catch (UnauthorizedAccessException ex)
            {
                messages.Text += "     You don't have permissions to delete the registry key.\n " +
                    "     Be sure you're running this application as an administrator.\n     " +
                    ex.Message + "\n";
            }
            catch (ObjectDisposedException ex)
            {
                messages.Text += @"     This exception should only occur if the registry key was deleted at the " +
                    "same time this delete request was made.  Aborting application run.\n     " + ex.Message + "\n";
            }
            catch (Exception ex)
            {
                messages.Text += @"     Uncaught exception, aborting: " + ex.Message + "\n";
            }
        }
        private bool clearFiles()
        {
            string path = Environment.GetEnvironmentVariable("WINDIR") + @"\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistanceExtension";
            if (Directory.Exists(path))
            {
                Directory.Delete(path, true);
                messages.Text += "Deleted files\n";
            }
            else
            {
                messages.Text += "Files do not exist\n";
            }
            return true;
        }
        private bool resetConfig()
        {
            /*
              located in
             * documents and settings/[username]/application data/mozilla/firefox/profiles/*.default/prefs.js
             *
             * key:
             *      user_pref("general.useragent.extra.microsoftdotnet", "(.NET CLR 3.5.30729)");
             *     
             * still haven't located
             *      microsoft.CLR.all_clr_versionts_in_useragent
             *  and
             *      microsoft.CLR.clickonce.autolaunch
             */
            return true;
        }
    }
}
Page 1 of 1 All times are UTC - 6 hours
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/