Does anyone know what the the Firefox Plugin Pando Web Plugin 1.0.0.1 is?


Since I found the rant against the Pando Media Booster in the other answer a bit inadequate, I've done some research.

First, it's clear what Pando Media Booster is and it is also clear that some (free to play?) Games use it to download the installer: For example, the free to play DDO game will tell you very clearly that it is going to use PMB to download the 3-4GB of installer data.

It does not tell you that it will install a browser plugin however, and there really doesn't seem to be any good info what the plugin actually is supposed to do.

But let's take a peek at the plugin database of Firefox, located at (Win7) C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\profilename.default\pluginreg.dat: It's a rather messy textfile, but some info is found easily enough:

npPandoWebPlugin.dll|$
C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll|$
1.0.0.1|$
1340047997129|0|4|$
Pando Web Plugin|$
Pando Web Plugin|$
1
0|application/x-pandoPlugin|This plug-in detects and launches Pando Media Booster||$

Aha! So it will "detect and launch PMB". The only question remains when it will detect and launch PMB.

Will it evilly start PMB whenever you start your browser and use up all of your bandwidth behind you back??!

Or will it, harmlessly, just start PMB when a file type of application/x-pando is clicked by you to initiate a transfer?

Well, we can tentatively check this by using, e.g., Process Explorer, to monitor processes and specifically also to monitor all internet connections that Firefox opens (this is on the TCP/IP tab of the process properties.)

So I go ahead and re-enable the plugin: ...

Now, is Firefox suddenly spinning up connections to somewhere or has it launched the PMB.exe behind my back??! Well, no, at least not during the last five minutes.

To answer the question

So, what I assume the purpose of this plugin is, is that it launches the Pando Media Booster in response to some action from the user, possibly by clicking on some appropriately MIME-typed link.


League of Legends installed this on my computer. What a rip off. Here's some information: http://foxsys.blogspot.com/2011/10/what-is-pando-media-booster-pandoexe.html

PMB.exe is a small application that is installed along with some free-to-use software such as League of Legends, Dungeons and Dragons Online, Lord of the Rings Online, NBC, etc… PMB.exe basically helps the company off-load the responsibly of sharing their media files, patches or installations directly by turning their user’s machines into Peer 2 Peer clients. (Rather than having pushing you a 600MB update file, which actually costs the company money, the users might receive parts of the file from hundreds of other players.)

And unsuspecting user that leaves PMB.exe running on their system is pretty much being forced to seed files to thousands of users ALL THE TIME (PMB.exe has been reported by users to use up to 80+% of their internet connection’s upload bandwidth.) For some users this could lead to their ISP throttling their connection and/or actually charging them extra $$$ for using more bandwidth than they knew they were using. Conclusion

Pando Media Booster isn’t a virus but might well be considered malware depending on how it was installed on your machine, if you were aware of it and if you were given an option to install it or not. In any event, it is legit malware and getting rid of it is an simple as pulling up your Programs and Features (Windows 7) and uninstalling it. Just be aware that it might get reinstalled with future installations or updates to the product that originally installed it.

Essentially, they've silently installed software that will enslave your computer to seed updates for their software so that they don't have to pay the bandwidth costs and you do.