ZHPDiag – Module P2 – Firefox extensions

For Wikipedia, the extensions are very numerous and allow you to add new features to the browser, as the weather in the status bar, a block ads from Web sites, Web development tools, etc.

Do not confuse with the plugin extension, that is a kind of add-on application, external to the software that uses it ; the extension is here rather to be taken as a change in the program. Related to the NPF module (Firefox Plugin Navigator). It allows you to list all the plugins installed for the Mozilla Firefox browser. Some plugins may be malware programs. Analysis of ZHPLite will help to identify.

– Search in the folder «» %Program Files%Mozilla FirefoxPlugins »

A further search is carried out in the following basic registries keys :

Overview ZHPDiag

—\\ Firefox, Plugins,starting,Search,Extensions (11) – 0s
P2 – EXT FILE: (.Mozilla Corporation.) — C:\Program Files-Mozilla Firefox-browser-features-e10srollout-mozilla.org.xpi>.Mozilla Corporation
P2 – EXT FILE: (.Mozilla Corporation.) — C:\Program Files-Mozilla Firefox-browser-features-firefox-getpocket.com.xpi>.Mozilla Corporation

Example of detection

—\\ Firefox, Plugins,starting,Search,Extensions (11) – 1s
P2 – EXT FILE: (.Tables – .) — C:\Users-Coolman-AppData-Roaming-Mozilla-Firefox-Profiles-v84dtymq.default-extensions-378507-extcorp.net.xpi>Adware.CloudAtlas
P2 – NPF: [HKLM] ["qvod.com/QvodShare"] – (.Shenzhen QVOD Technology Co.,Ltd – QvodShareModule.) — D:\QvodPlayer-npShareModule-x64.dll>Pup. Optional.Qvod