Block installing Firefox add-ons while on a LUA

I enabled the Software Restriction Policy on my Windows XP Pro PC by following the instructions at How to make a disallowed-by-default Software Restriction Policy
I have a user on my LUA that sometimes is a victim of social engineering and installs a malicious add-on/extension to Firefox. I tried preventing this by adding the XPI extension to the executables list in the SRP. This, combined with the Security Zone Policy, prevents downloading XPI files using “Save Link As”, but it does not prevent add-on installation by simply clicking on an XPI link within Firefox.

Does anybody have any ideas on how I can block installing Firefox add-ons while on a LUA?

The Adblock Plus add-on for Firefox is really great at blocking malware, preventing tracking and speeding up rendering on commercial sites. I considered moving to a different browser such as Opera that doesn’t support add-ons, but I don’t want to lose Adblock Plus.

Thanks in advance.

If you download and install “Spy Bot Search & Destroy”, then all you have to do is click “immunize”, and all malware add-ons will be automatically prevented.

If you want “SBS&D” to block all add-on downloads, you can enable a feature called “tea-timer”, it will prompt you the first time that a site requests to install an add-on and if you check the box that says “remember this decision” and then click block; all further request from that site will be blocked automatically.

Thanks for taking time to help me.

I found info on how Spybot prevents installation of malware Firefox add-ons at these sites:

http://kb.mozillazine.org/Hostperm.1

My understanding of this is that Firefox add-on installations are blocked only for the black list of domains supplied by Spybotd. I am looking to block them for ALL domains. Any other ideas?

Maybe the solution would involve setting a Firefox profile file to have read-only permission for the limited user.

I found a solution and posted it here:
https://forums.comodo.com/feedbackcommentsannouncementsnews_cis/how_to_block_firefox_extension_installs_with_cis-t41615.0.html

An LUA is not needed to achieve this specific goal, but it is still desirable for other reasons.