X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

Preventing uninstalls of incompatable addons enables predators, Why?

Posted

Hi:

 I'm helping a family with Firefox 15.01. Their children installed a rogue game plugin, Iwingames, which preys on children infecting computers, installing redirection adware etc. It's incompatible with Firefox 15.01. We know it's dangerous but it can't be disabled, not in safe mode, not manually. So sure as shooting, the rogue company will update their plugin and the computer will be infected again. Why is Firefox enabling predator companies by preventing users from disabling incompatible plugins? It's a ticking time-bomb. Do I have to tell them to cease using Firefox and switch to IE? WHAT ARE YOU THINKING!

Additional System Details

Installed Plug-ins

  • Shockwave Flash 11.4 r402
  • npsitesafety
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Adobe PDF Plug-In For Firefox and Netscape 10.1.4
  • Google Update
  • GEPlugin
  • 4.1.10329.0
  • VLC media player Web Plugin 2.0.0
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • NPWLPG

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1

More Information

Tried using info in posted articles.

the-edmeister
  • Top 10 Contributor
  • Moderator
3195 solutions 24398 answers

Plugins aren't installed in Firefox. Firefox uses plugins which are installed into the operating system. Uninstall the program which installed that plugin to get rid of the plugin - or just disable that plugin.

If that plugin is truly as bad as you make it out to be, file a Bugzilla report to make Mozilla aware of it. If Mozilla finds it to be a "bad" plugin they can blacklist that specific plugin so that it won;t work in Firefox and the user would need to manually enable it if it isn't really dangerous. (There's a couple of levels of blacklisting that Mozilla can use.)

https://bugzilla.mozilla.org/

Question owner

Hi:

 Make no mistake, these malicious plugins are installed by children who unknowingly trade away the safety of their family computer in exchange for free games. The programs are gone but the plugin/addon remains. Most admins glibly advice users to disable or uninstall the plugin, however, in addon manager a plugin incompatible with version x, cannot be uninstalled or disabled--not even in safe mode. You just have to wait for the unethical company to update the plugin and reinfect the system. 

We know it's a bad plugin. We need to have a way to get rid of it before it creates more havoc. It's not brain surgery. Firefox needs to allow users to disable and uninstall malicious plugins incompatible with the current version.

kreemoweet 0 solutions 5 answers

Who gave these children the privileges to install software in the first place? That is the root of the problem. Also, to repeat a previous answer: Plugins are NOT installed in Firefox. Firefox merely reports on their existence. Firefox CANNOT uninstall these things which have been installed in Windows, and Firefox CANNOT prevent the installation of such things. All Firefox can do is Disable its use in Firefox. Someone needs to hunt this malware down and use Windows tools to remove it.

Question owner

That's a bunch of malarkey. I can disable or uninstall every add-on EXCEPT add-ons incompatible with the latest version. I hunted down the malware and took it out but cannot disable or uninstall the addon because it's incompatible with 15.01. I am not asking Firefox to prevent installation; just enable users to disable known malicious add-ons that happen to be incompatible. If it's incompatible disable and uninstall are grayed out.

The family calls me today and drops off the computer. Words are underlined in web pages, linking to ad sites. It turns out to be the add-on, I want this. I go to the addon manager and remove it. Problem solved.

But there's no option to disable or uninstall anything incompatible with 15.01. I know that Iwingames is a malicious add-on but I can't disable or uninstall it. I got rid of the malware but it will come back when Iwingames make their add-on compatible.

Again it's a ticking time bomb. You shouldn't have to assemble a team of IT experts to use Firefox.

philipp
  • Top 10 Contributor
  • Moderator
2043 solutions 8891 answers

hello, there is a difference between plugins & extensions. what the contributors in this question have already explained, applies to plugins.

now it sounds like you are not referring to a plugin but to an extension that can't be uninstalled from within firefox' user interface. this is a problem when it is installed a special way in the firefox program folder (& that doesn't depend on it being deactivated because it's incompatible). you'd probably have to delete the extension file manually on the file-system like described in Cannot uninstall an add-on (refer to the section about 'globally installed extensions').

i agree that it will be probably better to create a separate limited user account for the kids, then such problems couldn't arise because software they download wouldn't have the permission to write into the program folder in the first place.

Question owner

Hi:

 Looking at posts regarding this problem, suggestions include removing the incompatible addon via safe mode, removing it manually or through addon manager. This problem has been reported since version 3 and the same suggestions have been made, None of them are effective, users have continued to report they are unable to get rid of these incompatible addons.

I've been using Firefox since beta .54 and have installed it on hundreds of machines but it's no longer safe for families to use. In the past it was an annoyance but there are many dangerous addons now with the only solution being a continual complete uninstall/reinstall of Firefox. It's a security hole a mile wide. If you have to create a limited account, try getting that across to the average user, to use Firefox--it's become high maintenance software.

I'll probably keep on using Firefox and will recommend it to the tech-savvy, but I'm going to start testing Chrome and Opera for families. Firefox is too predator friendly.

philipp
  • Top 10 Contributor
  • Moderator
2043 solutions 8891 answers

Helpful Reply

firefox does not prevent the removal of incompatible addons (see screenshot).

the problem you're referring to are so called globally installed extensions - and firefox does contain safeguards against them, they won't be enabled without explicit permission of the user in the first place.

James
  • Top 25 Contributor
  • Moderator
437 solutions 3152 answers

I agree with madperson that this sounds to be a Extension (listed in Tools->Add-ons->Extensions) and not a Plugin installed on system like Flash or Java.


There was no version of the browser with a number like 54 in version.

Question owner

Hi:

 It is an addon, not a plugin, and all were installed by unknowing users. The problem is not being able to uninstall or disable when the problem is identified.
jscher2000
  • Top 10 Contributor
2365 solutions 20922 answers

I think there is some confusion in this thread about the issue, which as I read it, is that extensions disabled due to incompatibility have their Options/Enable/Disable buttons hidden. If they can be removed from inside Firefox, their Remove buttons are still displayed. See Screen Shot #1.

For what it's worth (see Note), you can redisplay the button using a style rule. This can be created in userChrome.css or in the Stylish extension. Screen Shot #2 shows the rule in a Stylish window. The rule text is:

@namespace url(http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul);
@-moz-document url("about:addons") {
  richlistitem[type="extension"][notification="warning"] .disable[hidden="true"] {
    display:inline !important; outline:3px solid #f00 !important;
  }
}

The result can be seen in Screen Shot #3.

Note: What I don't know is whether the button actually works correctly, since I don't have an easy way to test that (i.e., an incompatible extension for which I actually have an update). There probably is a file in your settings folder (AKA Firefox profile folder) where the "user disabled" status is recorded, but I haven't researched it. So, whether having the button actually is useful, I do not yet know.

Edit: The userDisabled status is a column distinct from the appDisabled column in the extensions.sqlite database, so in theory, this should work, but again I do not have a convenient way to test it.

Modified by jscher2000

James
  • Top 25 Contributor
  • Moderator
437 solutions 3152 answers

The word Addon does not refer to one thing as it was a term Mozilla started using period of Firefox 2.0 or 3.0 to group together the separate Extensions, Themes, Plugins, Personas (toolbar themes) and even search engines and dictionaries (installed in Extensions panel).

In Tools->Add-ons manager there are separate panels for Extensions, Appearance (themes) and Plugins on left side.

You kept saying Plugin before and then say it is a Addon.

madperson posted a link on how to uninstall Extensions manually. https://support.mozilla.org/en-US/kb/Cannot%20uninstall%20an%20add-on#w_uninstalling-manually

cor-el
  • Top 10 Contributor
  • Moderator
10751 solutions 96754 answers

You can try to see if you can get the path with the SQLite Manager extension.

  1. Open Profile Directory -> extensions.sqlite -> Go
  2. Hit the Execute SQL tab
  3. Use a Select like this:
SELECT d.name,a.id,a.version,a.active,a.type,datetime(a.installDate/1000,'unixepoch'),datetime(a.updateDate/1000,'unixepoch'),a.location,a.descriptor
FROM addon AS a JOIN locale AS d ON a.defaultLocale = d.id
WHERE a.internal_id
the-edmeister
  • Top 10 Contributor
  • Moderator
3195 solutions 24398 answers

Less knowledge users interchange the term plugins, with add-ons, with extensions, etc. As explained by James, Plugins, Themes, Persona light-weight themes, and extensions are all add-ons the global term for stuff that is added to Firefox by the user or by other installed progarms. Each type of add-on installs or is installed in a different manner and is removed or uninstalled in a different manner.

Other than "a rogue game plugin" you haven't provided any specific information about what "we" are dealing with. Is the name a secret that you can't reveal for some reason or are embarrassed by? Hard to provide specific advice with out specifics.

Question owner

Hi:

@the-edmeister: If you would have read my posts, the first post, I name the extension/addon, Iwingames: I'm helping a family with Firefox 15.01. Their children installed a rogue game plugin, Iwingames, which preys on children infecting computers, installing redirection adware etc. It's incompatible with Firefox 15.01. @jscher: Thanks for the suggestion on enabling the button but this seems to be a mozilla policy for years. @Cor-el: When I went into the profile, I didn't find the extension listed but will keep your sql manager fix in mind for the future. Thanks! @All: This is the second sleeper addon/extension to plague the computer. "I want this" got updated and started underlining words in web pages, redirecting to ad pages. Anyway, I backed up their bookmarks and did a complete uninstall and then reinstalled. Firefox is still currently unsafe. Thanks for your suggestions.

jscher2000
  • Top 10 Contributor
2365 solutions 20922 answers

Firefox recently made it harder for third party software to slip in extensions without user consent, but there was user consent in your scenario.

Just to be clear: all extensions can be uninstalled. If there is no Remove button on the Add-ons page, then it must be uninstalled through the control panel, the program's uninstaller, or manually, by deleting it from the system. This is true whether the extension has been disabled as incompatible or not.

What is missing for an extension disabled as incompatible are the Enable and Disable buttons. The thinking behind that appears to be that Enable would have no effect and Disable is superfluous -- it's already disabled. Perhaps that should be reconsidered, but in the case you have presented, removal seems more appropriate.

cor-el
  • Top 10 Contributor
  • Moderator
10751 solutions 96754 answers

Firefox also shows the installation path of extensions with the app-global and app-system-user location in the description field with the above posted code, so you can give it a try with the SQLite Manager extension.

Modified by cor-el

philipp
  • Top 10 Contributor
  • Moderator
2043 solutions 8891 answers

Helpful Reply

@thenrik: When I went into the profile, I didn't find the extension listed

again, you're likely dealing with a globally installed extension here - it isn't located in the profile folder but the extensions-subfolder of the firefox installation directory (usually in C:\Program Files (x86)\Mozilla Firefox).

https://support.mozilla.org/en-US/kb/Cannot%20uninstall%20an%20add-on#w_globally-installed-extensions

cor-el
  • Top 10 Contributor
  • Moderator
10751 solutions 96754 answers

Extension can be added from any location by using a key in the Windows registry.

  • HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\extension-id
Thalia0123 1 solutions 13 answers

You keep repeating that firefox is unsafe, but it is not. However, it is not foolproof either. What users here are trying to explain, is that you can have the finest, high-tech alarm system available installed, but it will not do you any good if you don't close the door on your way out.

Like others have said, the plugin/extension/whatever it is, can be removed, and it was not due to firefox being 'unsafe for families' that it got installed in the first place. It was because the children were given full read/write access to sensitive parts of the system, which can only be blamed on the parents.

The only thing I have not yet seen suggested yet here, is wiping the old profiles and creating a new one. Have you tried this yet?

cor-el
  • Top 10 Contributor
  • Moderator
10751 solutions 96754 answers

If the extension is installed globally (i.e. not in the Firefox Profile Folder) then creating a new profile won't help and the extension may still be listed in "Tools > Add-ons > Extensions" as a disabled extension.