What is Pando Web Plugin?

Question

Does anyone know what the the Firefox Plugin Pando Web Plugin 1.0.0.1 is?

Solution 1

Since I found the rant against the Pando Media Booster in the other answer a bit inadequate, I've done some research.

First, it's clear what Pando Media Booster is and it is also clear that some (free to play?) Games use it to download the installer: For example, the free to play DDO game will tell you very clearly that it is going to use PMB to download the 3-4GB of installer data.

It does not tell you that it will install a browser plugin however, and there really doesn't seem to be any good info what the plugin actually is supposed to do.

But let's take a peek at the plugin database of Firefox, located at (Win7) C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\profilename.default\pluginreg.dat: It's a rather messy textfile, but some info is found easily enough:

npPandoWebPlugin.dll|$
C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll|$
1.0.0.1|$
1340047997129|0|4|$
Pando Web Plugin|$
Pando Web Plugin|$
1
0|application/x-pandoPlugin|This plug-in detects and launches Pando Media Booster||$

Aha! So it will "detect and launch PMB". The only question remains when it will detect and launch PMB.

Will it evilly start PMB whenever you start your browser and use up all of your bandwidth behind you back??!

Or will it, harmlessly, just start PMB when a file type of application/x-pando is clicked by you to initiate a transfer?

Well, we can tentatively check this by using, e.g., Process Explorer, to monitor processes and specifically also to monitor all internet connections that Firefox opens (this is on the TCP/IP tab of the process properties.)

So I go ahead and re-enable the plugin: ...

Now, is Firefox suddenly spinning up connections to somewhere or has it launched the PMB.exe behind my back??! Well, no, at least not during the last five minutes.

To answer the question

So, what I assume the purpose of this plugin is, is that it launches the Pando Media Booster in response to some action from the user, possibly by clicking on some appropriately MIME-typed link.

Solution 2

League of Legends installed this on my computer. What a rip off. Here's some information: http://foxsys.blogspot.com/2011/10/what-is-pando-media-booster-pandoexe.html

PMB.exe is a small application that is installed along with some free-to-use software such as League of Legends, Dungeons and Dragons Online, Lord of the Rings Online, NBC, etc… PMB.exe basically helps the company off-load the responsibly of sharing their media files, patches or installations directly by turning their user’s machines into Peer 2 Peer clients. (Rather than having pushing you a 600MB update file, which actually costs the company money, the users might receive parts of the file from hundreds of other players.)

And unsuspecting user that leaves PMB.exe running on their system is pretty much being forced to seed files to thousands of users ALL THE TIME (PMB.exe has been reported by users to use up to 80+% of their internet connection’s upload bandwidth.) For some users this could lead to their ISP throttling their connection and/or actually charging them extra $$$ for using more bandwidth than they knew they were using. Conclusion

Pando Media Booster isn’t a virus but might well be considered malware depending on how it was installed on your machine, if you were aware of it and if you were given an option to install it or not. In any event, it is legit malware and getting rid of it is an simple as pulling up your Programs and Features (Windows 7) and uninstalling it. Just be aware that it might get reinstalled with future installations or updates to the product that originally installed it.

Essentially, they've silently installed software that will enslave your computer to seed updates for their software so that they don't have to pay the bandwidth costs and you do.

Comments

[slhck]

pando.com/what ?

[Julian]

@slhck - Yes related. I got no good answers when googling for Pando Web Plugin so I thought we'd make one. (For me it apparently got installed with Pando Media Booster)

[slhck]

I have no idea what that really is, nor can I try, but let's see!

[Martin]

While this answer explains what PMB.exe is, it totally fails to answer the question, namely why this tool would need a Firefox plugin. (I certainly don't get it - it only (should) runs while the game is running and certainly isn't/wasn't installed as a service on my machine.)

[Alain]

@Martin It's inherently deceitful software. 1) It installs silently without the user knowing it's there. 2) It tries to hide while it's running so that it goes undiscovered. It has a firefox plugin because it's easy to tell when a program has set itself up to run on startup. The browser is something almost everyone uses when they're on the computer, so when the plugin runs, it allows the program to silently start itself up and use bandwidth under the disguise of being browser traffic.

[Martin]

Well when installing DDO it explicitly told me it's gonna install the thing and it also claimed it'll only run while DDO was installing. And I'm going to have to check whether the browser plugin actually does this transfer thing. (did you or is it just speculation?)

[Alain]

Speculation/Inference (hence comment). To know any more about this program I'd have to have it installed to research it (no thanks) or work for the company that made it (I'd rather die) .

[Martin]

Alain - I have checked the plugin (since it was lying around here anyway): See my answer. Personally I conclude that it is unnecessary but totally harmless.

[Alain]

Thanks for doing some original research. Did you test starting the browser while the plugin was enabled, or just re-enabling the plugin while the browser was already running?

[Martin]

I tried both (also after PC reboot). I can see no additional or suspicious connections from Firefox and no PMB.exe is running.

[Kissaki]

Did you restart Firefox after re-enabling the plugin?

[Martin]

@Kissaki - yes. see my previous comment right here.