POSTED BY

AT 2:49 PM
Saturday May 30, 2009

extensions • firefox • microsoft • security • software

"Microsoft Update Quietly Installs Firefox Extension"

Big deal, you say? I can just uninstall the add-on via Firefox's handy Add-ons interface, right? Not so fast. The trouble is, Microsoft has disabled the "uninstall" button on the extension. What's more, Microsoft tells us that the only way to get rid of this thing is to modify the Windows registry, an exercise that -- if done imprecisely -- can cause Windows systems to fail to boot up.

29 Comments

strider_mt2k

#1 – 3:01 PM May 30, 2009

My first thought would be to back up my bookmarks and uninstall/reinstall Firefox.

-but then again I shouldn't HAVE TO!!!

I don't see it on my Mini 9 running Win7 RC1, but I could swear I just saw that plugin on another machine of mine I just set up.

All of my computers at home are running RC1 at this point (otherwise really well) in something I'm calling "The Grand Experiment".

Ain't THIS grand? :|

Jeff Siegel

#2 – 3:32 PM May 30, 2009

I'm not a computer whiz....so what's the prob with Microsoft Firefox? Is there any reason I wouldn't want it on my system?

Michiel

#3 – 3:50 PM May 30, 2009

Microsoft is still around? I haven't been paying attention, but I assumed they must have died by now..

Blue

#4 – 4:19 PM May 30, 2009

Modifying someone's computer without permission is a crime in the UK and many other countries.

Deliberately disbaling the uninstall button is a clear bad-faith act on behalf of microsoft, that should prevent them from claiming 'helpfulness'.

That Mozilla allows software to do this to Firefox without user interaction is a security fail.

Raian

#5 – 4:24 PM May 30, 2009

And this will be how Firefox pays for the next few year of their operations (after the lawsuit is over)... or at the very least, a couple people will be losing their jobs.

guy

#6 – 4:24 PM May 30, 2009

With Microsoft, it's difficult to distinguish malice from incompetence.

Anonymous Anonymous

#7 – 4:38 PM May 30, 2009

"..the only way to get rid of this thing is to modify the Windows registry, an exercise that -- if done imprecisely -- can cause Windows systems to fail to boot up."

Wow. Sensationalism at its best. This is old news anyways. It was discovered months ago. The fix is pretty easy as long as you follow the instructions.

But I have to agree that this was pretty sneaky/evil of Microsoft to do this. For one thing, they should ask to install the extension. If they're not going to ask, then they should make it easy to remove it, rather than make people manually edit the registry and Firefox prefs.

Anonymous Anonymous

#8 – 4:47 PM May 30, 2009

Deliberately disbaling the uninstall button is a clear bad-faith act on behalf of microsoft

They didn't. Their installation takes place at a privileged enough level that makes it look to Firefox like it would be dangerous to uninstall it.

I don't mean to excuse their behavior -- I have went to some effort to avoid using Microsoft's products for many years now -- but this particular act doesn't quite rise to the level of bad-faith. (Though that was a wholly reasonable assumption to make.)

AirPillo

#9 – 4:57 PM May 30, 2009

My first thought is that there are several places in the world where this has got to be completely and unquestionably illegal.

mikeb

#10 – 5:40 PM May 30, 2009

Unfortunately, this is only partially Microsoft's fault. Firefox makes
it easy for applications to ship their own browser extensions - they
only need to add a registry entry that points to the extension's
directory. But Firefox cannot uninstall extensions that were installed
like this (because it didn't install them in the first place, because
it might require administrator rights and because doing that would
affect other Firefox profiles as well).

Zan

#11 – 5:40 PM May 30, 2009

FUD much? The uninstall button wasn't intentionally removed as a sign of bad faith. Microsoft installed the add-on in the global extensions directory, not the profile specific one (so that multiple copies wouldn't be needed on a multi-user machine). It is Firefox which chooses to disable the uninstall button on global add-ons. Besides, when is the last time that you heard of someone making their computer unbootable while following specific instructions on editing one registry key?

In any case, this is OLD news. The original update was released in February, and Microsoft already released an update that moves the extension to the individual profile folders so that it can be easily uninstalled.

sworm

#12 – 5:52 PM May 30, 2009

lol.

i don't miss windows.

MrNeutron

#13 – 5:52 PM May 30, 2009

Yes, I was going to see, I see a nice big uninstall button sitting next to the plugin on my Firefox.

alex

#14 – 6:36 PM May 30, 2009

as if anyone really needed another reason to go completely open-source on their computer....

zuzu

#15 – 7:46 PM May 30, 2009

My first thought is that there are several places in the world where this has got to be completely and unquestionably illegal.

WTF. Laws? This is the Internet, son.

Book: Shouldn't we report this?
Captain Tightpants: To who? Alliance? Right. They're gonna run right out here lickety-split, make sure these taxpayers are okay.

Besides those some laws you speak of have been perverted by spyware authors to inhibit anti-spyware software from removing them. ...which is why the best anti-spyware for Windows, Kaspersky, is downloadable from the jurisdiction of Russia.

strider_mt2k

#16 – 8:09 PM May 30, 2009

I just found it on one of my Win7 machines and it uninstalled without a hitch.

-Latest Firefox
-Win7 RC1

I'm going to go out on a limb and say it might be my version of Windows, but maybe it's just a bug or glitch?

SeppTB

#17 – 8:49 PM May 30, 2009

Strider, As #7 Zan mentioned, this was an old issue and has since been fixed by Microsoft: http://blogs.msdn.com/brada/archive/2009/02/27/uninstalling-the-clickonce-support-for-firefox.aspx

I'm not sure if the fix came before or after Brian Krebs article though. Personally, I never even noticed this, I must have not installed that update, hmm.

strider_mt2k

#18 – 8:56 PM May 30, 2009

Oh man it was right there too.

Sorry!

obo

#19 – 9:00 PM May 30, 2009

This Krebs guy just identified himself as someone who waits four months to install security-patching service packs.

icky2000

#20 – 11:58 PM May 30, 2009

No actual story here. Move along.

Ville

#21 – 1:35 AM May 31, 2009