Removing The ClickOnce Microsoft .NET Framework Assistant from Mozilla Firefox
The Issue
Microsoft added a firefox addon that enabled “Click Once” and the .NET Framework to function inside of the browser. Some people were clearly upset by this. They were afraid that this would compromise firefox security, by exposing it the same security issues as Internet Explorer. Because of this addon, more people are asking is Firefox better than Internet Explorer.
The Microsoft .NET Framework Assistant Addon for Firefox enables the browser to tell web pages what versions of the .NET Framework are installed. It also allows you to install software with a single mouse click. Sounds good right? What happens if the software includes malware? Or what if you click on a button for something else, and through “clickjacking” you actually install the software? Both of these are real possibilities with Internet Explorer– and now Firefox.
One concern is that the addon was installed at the Machine Level, which means that users can’t uninstall it through Firefox. While Microsoft did downplay this concern, they released the steps to remove the Addon. And they have released a patch that will enable the “Uninstall” button on a per-user basis. This is still a compromise of firefox security because malware can install the addon under a different user account, and use it to infect your computer without your knowledge. Firefox was praised for being more secure than Internet Explorer because you couldn’t run ActiveX through it.
How to Remove the Addon
Microsoft and the bloggers who report on this make the steps to remove the Microsoft .NET Framework Assistant from Firefox sound dangerous and time consuming. I followed the steps and it wasn’t very hard at all. Microsoft even includes a command line argument that takes care of part of it for you. If you want to permanently remove this addon (instead of enabling it on a per- user level), here are the steps (from Microsoft)
1. Open a Command Prompt (Windows Key + R then cmd). In Vista, you must run it as an Administrator (which should happen automatically).
2. In the command prompt paste the following:
For x86 computers (32-bit):
reg DELETE “HKLM\SOFTWARE\Mozilla\Firefox\Extensions” /v “{20a82645-c095-46ed-80e3-08825760534b}” /f
For x64 machines:
reg DELETE “HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions” /v “{20a82645-c095-46ed-80e3-08825760534b}” /f
3. Reset the changes made to the Firefox user agent
i. Inside of Firefox, type in ‘about:config’
ii. Use the ‘Filter’ to find Preference name ‘general.useragent.extra.microsoftdotnet’
iii. Right-click on the item and select ‘reset’
iv. Restart Firefox
4. In your Run box (Win Key + R) paste the following:
%SYSTEMDRIVE%\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation
5. You’ll see a subfolder called DotNetAssistantExtension. Delete this folder and all of its contents.
That should remove the addon permanently. If you want to remove the addon, this is the recommended method. If you want to enable it on a per-user basis, the Microsoft blog listed in my references includes the link to the patch.
Notes for Firefox 3.6.x or Windows 7 users.
Microsoft’s support site now includes the following notes…
“If you install Firefox 3.6 and the .NET Framework Assistant appears, then you need to remove it with method 2..
Windows 7 and the .NET Framework 4.0 will include this assistant also.”
References
https://blogs.msdn.com/brada/archive/2009/02/27/uninstalling-the-clickonce-support-for-firefox.aspx Information about the Addon and the steps to remove it.
https://annoyances.org/exec/show/article08-600 An article that describes the user concerns.
https://blogs.techrepublic.com.com/security/?p=1716&tag=nl.e019 This is the blog post where I discovered this issue.
