Adblock Plus and (a little) more
The return of .NET Framework Assistant · 2009-08-10 11:34 by Wladimir Palant
Do you remember the commotion about Microsoft silently installing its .NET Framework Assistant extension through Windows Update? And how everybody was upset about this being forced down their throats, even without an “Uninstall” button in the add-ons window? And how Microsoft fixed at least the "Uninstall" button? And how that fix broke Adblock Plus and NoScript temporarily, causing tons of complains for both extensions? Well, the show isn’t over yet, lean back and watch.
I was getting occasional complaints from people claiming that Adblock Plus broke Firefox user interface — with Adblock Plus installed they would get empty spaces in the Tools menu and in the context menu, and there would be an “empty resizable frame” at the bottom of the Firefox that would just not go away. While it was obvious what happened here (one of two Adblock Plus overlays failed to apply) I had a very hard time figuring out why. The issue was similar to the one mentioned above that people were experiencing with the .NET Framework Assistant extension — except that this extension wasn’t installed. In fact, some people went as far as to create a new Firefox profile with Adblock Plus being the only extension. And the problem still wouldn’t go away.
Being tired of guessing I asked a user to give me remote access to his computer. He agreed and after some experimentation I could exclude malware and malfunctioning security software as the cause. I also didn’t discover any unusual preferences or the like. Then I had a look at the extension registration files in his Firefox profile directory. And one entry caught my attention: .NET Framework Assistant.
So, why is .NET Framework Assistant listed in the extension registry when supposedly it isn’t installed? Well, because it is installed, at least somewhat. Here is how Microsoft’s “fix” for the uninstall problem above works: the .NET framework installs a global Firefox extension as it did before. However, now it is only a minimal “bootstrap” extension meant to install the “real” .NET Framework Assistant in user’s profile. Once that is done the extension in profile takes precedence and the “bootstrap” extension is no longer active. However, if the user chooses to uninstall the .NET Framework Assistant extension the “bootstrap” extension becomes active again. So, wouldn’t users be confused if they uninstall one .NET Framework Assistant and notice another one pop up instead that they can no longer uninstall? They sure would be. But Microsoft found a very “elegant” solution for this problem — they simply marked the “bootstrap” extension as hidden so that it would no longer show up in the list of add-ons.
The problem was actually being caused by that extension. And due to the fact that it wouldn’t show up in the list it was also very hard to find the cause. Not to mention that marking the extension as hidden made it impossible to disable the globally installed extension — an option that the original version of the extension did offer. Well done addressing concerns! On the bright side, I was able to include a workaround in the current Adblock Plus development build that cures the problems (this is also going to be included in Adblock Plus 1.1.1, to be released very soon).
The technical details, if you are interested: the “bootstrap” extension defines a browser overlay in its chrome.manifest file. However, on that particular machine its chrome directory was empty, no UI files whatsoever (I guess they were there originally but were removed after installation of the “real” extension to make sure it is not installed again). So Firefox tries to apply an overlay and fails because the file doesn’t exist. This makes Firefox cranky enough that it doesn’t apply other outstanding overlays (is there a bug on that? need to check). The workaround was to override the overlay URL with a data: URL, that way the overlay exists and Firefox is happy.
Comment [27]
Commenting is closed for this article.
Karel Koubek · 2009-08-10 12:19 · #
Is there a way to remove this global version once and for all? How can one make the hidden extensions visible? It’s quite shocking that applications can install extensions without user consent that are hidden and Firefox doesn’t have remedy for that.
Reply from Wladimir Palant:
If another application really wants to mess with Firefox it will be able to do that, it’s plain and simple like that. Firefox really cannot prevent this. The solution is not to install applications that would mess with Firefox :-(
As to removing, see http://technologyexpert.blogspot.com/2009/05/how-to-rid-yourself-of-microsofts.html. Unfortunately, this won’t prevent the next .NET framework update from installing it again. Personally I added write protection for that particular registry key but there doesn’t seem to be a simple way of doing it.
Colby Russell · 2009-08-10 12:27 · #
Remedy? The Mozilla codebase includes code specifically to make hidden add-ons possible.
Henrik Gemal · 2009-08-10 12:28 · #
Yes Firefox is not very happy about overlays that doesn’t exist.
It would be a nice bug to fix, since I also had to add to hacks to some of my extensions to work around this bug.
I wasn’t aware that you could have extensions installed that didn’t show up in the addons list. Or have I misunderstood something?
Reply from Wladimir Palant:
Yes, there is an <em:hidden> tag that app-global extensions can use in install.rdf. Not sure what the original purpose of it was but that’s certainly not it. Not that an extension cannot make itself invisible by other means once it is installed of course…
Gijs · 2009-08-10 12:42 · #
Do you have the bug # handy for the issue of Firefox neglecting to apply overlays after it finds one broken one? Would be nice if we could get that fixed…
Reply from Wladimir Palant:
I found https://bugzilla.mozilla.org/show_bug.cgi?id=136346 and https://bugzilla.mozilla.org/show_bug.cgi?id=186667. The former should still be the right bug for this issue – but the latter might offer a hint towards what’s going wrong (unless the reason changed in the past 7 years of course).
b3virq3b · 2009-08-10 13:35 · #
I wonder why there hasn’t been many complaints about Sun’s Java Console extension. The menu item it adds in the Tools menu has never worked for me (simply greys out and doesn’t open the console), and the extension is hidden as well so it can’t be disabled easily.
Reply from Wladimir Palant:
Probably because it just adds a feature that Mozilla Suite had before (and I think early Firefox versions as well). Also, it is not a feature that would become active on its own (in particular, it won’t download and run code from the web, whether sandboxed or not).
Mossop · 2009-08-10 13:36 · #
Colby, yes the codebase currently includes a basic way to hide extensions that were installed on the system by other applications. It’s important to note that extensions you download from the web and install through Firefox cannot use this mechanism.
The point was originally to allow system administrators to install Firefox along with a set of core extensions for their business that wouldn’t show up in the normal list, however more third party installers are starting to use it and so, unrelated to this Microsoft case, we are already talking about removing the built in hidden support in the next release of Firefox.
Of course with extensions being what they are (and particularly this class of extension that are installed by code already running on your local computer), they will always be able to hide themselves from the user whether we give them an easy way to do that or not.
Gaby · 2009-08-10 13:58 · #
And Microsoft wonder why people don’t trust them… It’s so annoying they think it’s okay to do things like this!
eupator · 2009-08-10 14:07 · #
If the breakage manifests without ABP being installed as well, perhaps you may wish to ask evangelism to nudge Microsoft to fix their addon, or, would that fail, to nominate it for being blacklisted.
Reply from Wladimir Palant:
It is not exactly limited to ABP but I don’t think you will see the breakage without any extensions at all.
Spade · 2009-08-10 14:16 · #
Egad… somebody within Microsoft needs it patiently explained to them that unwanted stealth installs messing with their primary browser competition is not exactly going to make them any friends at the EU.
nobody · 2009-08-10 15:49 · #
How about a more proactive approach; an extension that offers a dialog prompting users to remove any “hidden” extensions on startup?
ecjs · 2009-08-10 20:33 · #
In other words, welcome to a new era : firefox extensions silently installing and hiding. How would you call that: fireware, foxware ?
Banhammer · 2009-08-10 22:41 · #
Mozilla needs to permanently ban the .Net Framework extension, since Microsoft monkeys can’t code, period.
Morac · 2009-08-10 22:45 · #
Despite the sneakiness of Microsoft’s .NET Framework Assistant extension, the problem technically isn’t with that extension.
I’ve looked at the code of Microsoft’s .NET Framework Assistant extension and the chrome folder files are never removed (on an install or uninstall) so they should have been there. Another program (or the user) must have removed them which is what caused the problem.
There is a bug in the .NET Framework Assistant extension which causes it to throws errors whenever a browser window is opened (namely it tries to do a clearUserPref(“microsoftdotnet”) even if the preference doesn’t exist) when the extension is “uninstalled”, but other than producing errors in the error console, that doesn’t cause problems.
Reply from Wladimir Palant:
Sure, the extension cannot remove itself – already because it doesn’t have the necessary write privileges for the directory. It must have been done by privileged code – Windows Update, .NET Runtime service, maybe even .NET Framework uninstaller. I don’t know which one it was but fact is that this is a common issue.
cubefox · 2009-08-13 03:52 · #
According to this problems also see bug 476430.
https://bugzilla.mozilla.org/show_bug.cgi?id=476430
Henk · 2009-08-13 17:28 · #
@Colby Russell and Mossop
Is there any way to see if there are other hidden FF extensions installed on my computer?
Barrie · 2009-08-14 12:08 · #
damn,I removed it yesterday in this way: http://technologyexpert.blogspot.com/2009/05/how-to-rid-yourself-of-microsofts.html
When searching with windows update for new updates today, update to .net framework 3.5 sp 1 for the FF add-on was found with Important priority, after checking my update history, it was already installed on the 24th of June(KB963707), If I wouldn’t have manually checked, the update would have automatically installed, restoring the stupid addon which I just thoroughly removed. So after you remove it, manually check for updates, and disable the update before it has the chance to infect Firefox..
Just Me · 2009-08-16 17:13 · #
Thank you so much for this article. I’m not very technical and have been feeling like my computer was possessed. I had narrowed my firefox problems down to the .net framework add-on and disabled it already. That helped until I uninstalled the add-on. This started the problems, though not as bad, all over again. Now I can turn my computer over to the proper guru fix. Thank you.
celtic · 2009-08-17 19:18 · #
I deleted this annoyance too. By the way I uninstalled all versions of .Net Framework from my computer. For people who do not need this .Net crap visit this blog :
http://blogs.msdn.com/astebner/archive/2005/04/16/408856.aspx or
http://blogs.msdn.com/astebner/archive/2005/04/08/406671.aspx
strel · 2009-08-18 18:56 · #
For your information, you can avoid installing .NET Framework Assistant Firefox add-on while installing .NET 3.5 SP1 with this:
http://www.msfn.org/board/silent_net_maker_synthesized_20090819_w2k_xp_2k3_x86-t127790.html
undefined · 2009-08-21 06:48 · #
So at this point, what’s the best way to keep this junk out of my Firefox install? Some MS update just pushed this stuff onto my computer.
For now, the extensions isn’t being loaded because it’s “incompatible with Firefox 3.5.2”, but I suspect a future update will “fix” that “problem”, and what should I do then? If I disable the visible extension, then the “bootstrap” extension will still be active, right? Is this a security risk or not?
This update also conveniently added a new background service… I’m tempted to just remove .NET from my system altogether, but reading comment 13 above (and the response), I don’t want to risk breaking Firefox if the uninstaller is a possible cause of the problem… I also can’t recall which program wanted me to install .NET in the first place, and I don’t want to break something important.
After all the backlash, you’d think MS would just stop bundling this extension and let people get it from AMO (it’s actually listed there) if they want it, but I guess that would make too much sense.
fakeraol · 2009-08-23 17:22 · #
how, does disabling the uninstall-button work? (and how to reenable ;-) )
undefined · 2009-08-24 10:00 · #
Never mind what I said before about a background process. It only persists until the next time the computer is idle for a while, at which point it apparently does some kind of cleanup and disappears (forever?). Still interested in learning the best way to keep the Firefox extension disabled, though.
Bill · 2009-08-28 11:39 · #
C# and .Net Framework is the best. Java and PHP sucks.
ugg shoes · 2009-09-03 10:46 · #
anyway it’s a good site
jcm · 2009-10-17 04:19 · #
Well, I encountered the same problem with Adblock and Google Talk.
The problem is easy to reproduce: – install Google Talk, it will add some plugins into Firefox – uninstall Google Talk, the plugins will remain
When you surf the web, it crashes randomly.
Solution: go to the plugins options, and disable the extension.
Since you blame Microsoft, why not blaming Google for this bug ?
Woog · 2009-10-17 05:47 · #
The biggest problem with this .NET Firefox extension crap is not so much the problems it causes, but the fact that it’s hidden, hard to uninstall (impossible for average users without Google), or both… AND that it installed itself without any sort of prompt or notification of any sort!
I got this damned infection by installing a video game. What the hell does Batman have to do with .NET framework on Firefox??
MonztA · 2010-06-10 14:47 · #
Here we go again: http://arstechnica.com/microsoft/news/2010/06/microsoft-slips-ie-firefox-add-on-into-toolbar-update.ars