Forum Thread: update MSXML 4?

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft XML Core Services (MSXML) 4.x

This thread has been marked as locked.
ingber update MSXML 4?
Member 14th Jul, 2014 16:19
Ranking: 1
Posts: 14
User Since: 26th Nov, 2008
System Score: N/A
Location: N/A
My PSI utilty is telling me to update MSXML 4.0 SP3 Parser to 6.x by going to
http://www.microsoft.com/en-us/download/details.as...
I do also see MXXML6 on my Thinkpad Carbon Touch/Windows 8.1 Update x64, but I downloaded and clicked on the msi for msxml6.msi anyway. I no change in the Program listings?

How should I update this?

Thanks.

Lester

Maurice Joyce RE: update MSXML 4?
Handling Contributor 14th Jul, 2014 16:30
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Lester,
MSXML 4 is not native to Windows 7 or 8. You must have downloaded an old programme dependant on it to work. This should help - I know of Windows 8 users who have installed it without error but please note I have NOT TESTED it on my Windows 8 PC.

MSXML ISSUES

The release note for MSXML 4 are here:
http://download.microsoft.com/download/A/2/D/A2D85...

Please note this SP was released before Windows 7 & 8 was produced therefore there is no mention of compatibility or support once installed - it works flawlessly with Windows 7 on both 32 & 64 Bit systems. I have NOT tested it on my Windows 8 or 8.1 PCs because I have no old legacy programmes that require it to be installed.

Firstly, it is important to note the VERSION NUMBER currently installed which PSI gives in the vulnerability report because there are three possible solutions.

Solution 1
If PSI gives a version number starting 4.2 or 4.1 that indicates that the very old MSXML 4 SP2 or even older SP1 is installed which must be MANUALLY upgraded to MSXML 4 SP3 as follows:

Click this link: (please note that the system requirements for this download do state that Windows 7 is supported unlike the release notes)

http://www.microsoft.com/en-us/download/details.as...

Once open activate the clearly marked download link called MSXML.MSI - 2.3 MB.

Once installed run & rerun Windows Update - there are some additional patches for MSXML 4 SP3.

On completion PSI will show MSXML 4 as secure with version 4.30.2117.0. like this:

https://1ncuig.bn1303.livefilestore.com/y2p1ys7jrr...

Solution 2
If PSI reveals the path to be 4.3 that almost certainly indicates that the latest Windows Update patch is not installed correctly. Run a Windows Update scan - if that reveals nothing try a manual update using this link:

http://www.microsoft.com/en-us/download/details.as...

Solution 3

If MSXML 4 SP3 BETA is installed ensure it is fully removed prior to using Solution 1. The Release Notes referred.

Hope this helps.

Revised 15:21 14/07/2014

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+2
-0
ingber RE: update MSXML 4?
Member 14th Jul, 2014 17:05
Score: 1
Posts: 14
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
Hi. On my Thinkpad (using cygwin) I see
% locate -i msxml4
/cygdrive/c/Windows/System32/msxml4.dll
/cygdrive/c/Windows/System32/msxml4r.dll
/cygdrive/c/Windows/SysWOW64/msxml4.dll (the one referenced by PSI)
/cygdrive/c/Windows/SysWOW64/msxml4r.dll
/cygdrive/c/Windows/WinSxS/x86_microsoft.msxml2r_6 bd6b9abf345378f_4.30.2100.0_none_03d8af9e7277524d/ msxml4r.dll
/cygdrive/c/Windows/WinSxS/x86_microsoft.msxml2_6b d6b9abf345378f_4.30.2100.0_none_3983779e74974f83/m sxml4.dll

I also have version 6 -- lots of lines, including
/cygdrive/c/Windows/System32/en-US/msxml6r.dll.mui
/cygdrive/c/Windows/System32/msxml6.dll
/cygdrive/c/Windows/System32/msxml6r.dll
/cygdrive/c/Windows/SysWOW64/en-US/msxml6r.dll.mui
/cygdrive/c/Windows/SysWOW64/msxml6.dll
/cygdrive/c/Windows/SysWOW64/msxml6r.dll

Windows Update shows up to date; I check this regularly.

I thinkk you are saying that I should upgrade my v4 from 2100 to 2117, but PSI says to upgrade to v6?

Thanks.

Lester

Was this reply relevant?
+0
-0
ingber RE: update MSXML 4?
Member 14th Jul, 2014 17:39
Score: 1
Posts: 14
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
It seems that your solution 2, since I have SP3, bombs with that download:
the log file is not writable?
Was this reply relevant?
+0
-0
rd52 RE: update MSXML 4?
Member 14th Jul, 2014 18:05
Score: 21
Posts: 80
User Since: 4th Dec 2008
System Score: N/A
Location: US
"On completion PSI will show MSXML 4 as secure with version 4.30.2117.0. like this:"

This is what I am seeing displayed in Secunia, and it is being displayed as insecure. I have run ms update and none are available. My machine is Windows 7, 64 pro.
Was this reply relevant?
+0
-0
ingber RE: update MSXML 4?
Member 14th Jul, 2014 18:05
Score: 1
Posts: 14
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
I ran msxml4-KB2721691-enu.exe in XP SP3 compatibility mode. It ran OK, and now I see a new entry in my Program Files: MSXML 4.0 SP3 Parser (KB2721691)

I guess I do not see what this has accomplished?
Was this reply relevant?
+0
-0
Maurice Joyce RE: update MSXML 4?
Handling Contributor 14th Jul, 2014 18:21
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
What path does PSI now give to the problem?

FINDING A FILE PATH USING PSI

VERSION 2


From the DASHBOARD page click on SCAN RESULTS.

1. This will list all your programmes with a + to the left of each programme.
2. Click the + sign next to the item that you want help with.
3. This will reveal the path under DETECTED INSTANCES.
4. Below DETECTED INSTANCES you will see this You can double click this row for additional information & options>double click it>a box will appear>look to the RIGHT & you will see TROUBLESHOOT REPORT in BLUE writing under the heading TOOLBOX> click TroubleShoot Report & it will reveal some information in a box>highlight the information revealed from ---START--- to ---END--- & copy it (CTRL+C) then post it to the Forum (CTRL+V) if you want more help.

VERSION 3
This version does not have such an easy method to publish the path.

Open PSI>once open select Show Programs.
You will now see a page full of programme icons or a list.
Right click on the programme in error>select Show Details - that will open a box showing the path & version number of the offending file.
You now have 3 options:
1. Write down the exact file path & install version - return to the Forum & type that information.
2. Take a screen shot & publish that.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
ingber RE: update MSXML 4?
Member 14th Jul, 2014 18:35
Score: 1
Posts: 14
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
Maurice:

Using step 2, I did not need to run in compatability mode -- I just had to run as administrator. This puts me at v 4.30.2114.0, up from 2110, but still not high enough to satisfy PSI. I still have no updates to add under Windows Update.

The path shown (I cannot add an attachment here) is
C:\Windows\SysWOW64\msxml4.dll

Thanks.

Lester
Was this reply relevant?
+0
-0
rd52 RE: update MSXML 4?
Member 14th Jul, 2014 18:44
Score: 21
Posts: 80
User Since: 4th Dec 2008
System Score: N/A
Location: US
Here is the path Secunia displays. As I said before, it is pegged as being a liability.


file location: C:\Windows\SysWOW64\msxml4.dll
Installed version: 4.30.2117.0
Was this reply relevant?
+0
-0
Maurice Joyce RE: update MSXML 4?
Handling Contributor 14th Jul, 2014 19:17
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Lester,
I would run a full PSI rescan. On completion the PSI results should be like this:

https://1ncuig.bn1.livefilestore.com/y2pEVvzUt5KfF...

If PSI is still showing MSXML 4.30.2117.0 as vulnerable run a manual Windows Update scan - as my previous post stated once MSXML 4 SP3 is manually installed additional updates will be available via Windows Update.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
ingber RE: update MSXML 4?
Member 14th Jul, 2014 19:20
Score: 1
Posts: 14
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
I have MSXML 4.0 SP3 (now at 2114). There are no pending Windows Updates, and I get all reocommended & Other patches.
Was this reply relevant?
+0
-0
leskoonk RE: update MSXML 4?
Member 14th Jul, 2014 19:54
Score: 3
Posts: 5
User Since: 15th Jun 2010
System Score: N/A
Location: N/A
Last edited on 14th Jul, 2014 19:57
For what it's worth, I have the same problem.

Secunia PSI 3.0 shows the vulnerability.

I have MSXML 4 version 4.30.2117.0
A manual MS update shows no available updates.

A full rescan does not clear the vulnerability.

I am running Windows 7 64-bit.

I am seeing this on 2 different computers. A third computer does not show this, but it has MSXML 3 and 6 installed (not 4). The other 2 which are failing have 3, 4, and 6.

Larry
Was this reply relevant?
+1
-0
rd52 RE: update MSXML 4?
Member 14th Jul, 2014 20:18
Score: 21
Posts: 80
User Since: 4th Dec 2008
System Score: N/A
Location: US
I tried everything that was suggested and nothing worked. The only way to have Secunia not flag them was to put them in the recycle bin. So far I haven't noticed any problems with any other programs.
Was this reply relevant?
+0
-0
ingber RE: update MSXML 4?
Member 14th Jul, 2014 20:42
Score: 1
Posts: 14
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
Yes, I to have the same exact problem on two Thinkpad Carbon X1 Touch PCs running Windows 8.1 Update x64. They have the same hardware & OS, but different owners with different personal software.
Was this reply relevant?
+0
-0
MorningSleeper RE: update MSXML 4?
Member 14th Jul, 2014 22:16
Score: 0
Posts: 9
User Since: 4th Jul 2012
System Score: N/A
Location: US
Last edited on 14th Jul, 2014 22:18
Same situation, tried everything suggested, using Windows 7 64 bit ...

http://s27.postimg.org/ui7u9ve5v/Capture.jpg
Was this reply relevant?
+0
-0
Maurice Joyce RE: update MSXML 4?
Handling Contributor 14th Jul, 2014 22:19
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I have now managed to reproduce the problem you are now describing.

Earlier I completed a full PSI scan which produced this result which I published.

https://1ncuig.bn1.livefilestore.com/y2pEVvzUt5KfF...

My latest scan a few minutes ago produced this:

https://1ncuig.bn1.livefilestore.com/y2p-Tua-TwKcf...

I am treating the latest result as A FALSE POSITIVE.

MSXML 4 was never meant for nor is it native to Windows 7/8 or 8.1. It has technically been EOL for a long time but Microsoft have maintained its security to facilitate users who may have legacy programmes dependant on it particularly Vista users.

Secunia's advice is misleading - if you have MSXML 3 & 6 installed & showing as secure then trying to manually update them is fruitless & will not change anything.

It may be a good idea for someone to alert Secunia that their database requires adjustment unless they are claiming that all legacy programmes reliant on MSXML 4 are also EOL in which case they should publish the Microsoft source document.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+8
-0
leskoonk RE: update MSXML 4?
Member 14th Jul, 2014 22:23
Score: 3
Posts: 5
User Since: 15th Jun 2010
System Score: N/A
Location: N/A
Last edited on 14th Jul, 2014 22:25
Thank you Maurice.

Does anyone know how one can uninstall MSXML 4 (leaving 3 and 6 intact) ?

It is not obvious how this can be done. (Looking at the control panel software uninstall only shows the updates that have been applied, not the package itself.)

And, given your research and conclusion, can't one simply mark the error to be ignored ?

Many kind thanks,

Larry
Was this reply relevant?
+0
-0
Maurice Joyce RE: update MSXML 4?
Handling Contributor 14th Jul, 2014 22:54
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Larry,
If you do not like the red icon or want to show a 100% score just create an ignore rule. There is NO EVIDENCE that MSXML 4 SP3 (4.30.2117.0) is vulnerable therefore such an action is perfectly safe.

Perhaps in due course Secunia will change their stance & retract the EOL notice or make a statement on what new evidence they have to change its status.

If you remove MSXML 4 any programmes you have installed that requires it will fail. These files should be in Control Panel>Program & Features - I personally would use them to remove MSXML 4 but have no intention of doing so.

https://1ncuig.bn1.livefilestore.com/y2pqb02eiLvGf...

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+1
-0
henry8th RE: update MSXML 4?
Member 14th Jul, 2014 23:11
Score: 15
Posts: 19
User Since: 23rd May 2013
System Score: N/A
Location: US
Update Problem.
I have Vista SP2.
PSI scan shows MSXML 4 ( 4.30.2117.0 ) as End Of Life )
I did a manual Microsoft update scan showing no updates available.
I clicked on the link from PSI which took me to the Microsoft MSXML 6 update page
Download was abnormally quick and run was abnormally quick. I clicked finish as instructed. It seemed being so quick that there was nothing there which downloaded or ran. Also, i checked my programs and nothing showed being downloaded. Also a restart and new PSI scan still showed End Of Life result.

Any ideas as to what is wrong or why I cannot update this End Of Life program?



--
Mister P
Was this reply relevant?
+0
-0
Maurice Joyce RE: update MSXML 4?
Handling Contributor 14th Jul, 2014 23:26
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
See the posts above - it explains that trying to update MSXML 6 can be a waste of time.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
trocker RE: update MSXML 4?
Member 14th Jul, 2014 23:28
Score: 5
Posts: 12
User Since: 29th Nov 2011
System Score: N/A
Location: US
Last edited on 14th Jul, 2014 23:29
on 14th Jul, 2014 22:54, Maurice Joyce wrote:

If you remove MSXML 4 any programmes you have installed that requires it will fail. These files should be in Control Panel>Program & Features - I personally would use them to remove MSXML 4 but have no intention of doing so.

https://1ncuig.bn1.livefilestore.com/y2pqb02eiLvGf...


For what its worth: I tried uninstalling all the msxml items in the Programs list; they all uninstalled successfully, but c:/windows/syswow64/msxml4.dll was still present in the syswow64 folder, and PSI still complained about the end-of-life file.

Was this reply relevant?
+0
-0
rd52 RE: update MSXML 4?
Member 15th Jul, 2014 00:12
Score: 21
Posts: 80
User Since: 4th Dec 2008
System Score: N/A
Location: US
Trocker, what I did is I went to the c\windows\sysWOW64\msxml4.302117.0 and dragged it and msxml4r to the desktop. I then ran Secunia scan and it still said they were a risk. Only when I put them in the recycle bin did Secunia not flag them as a risk. When I did that I checked most of my programs and didn't have any problems. I have since put them back in sysWOW and Secunia says they are a risk, for now I just told Secunia to ignore it.

The question I have is, if I delete it in the control panel, delete it manually in the sysWOW file and I have a problem can't I just delete the problem progrram and re-install it?
Was this reply relevant?
+0
-0
ingber RE: update MSXML 4?
Member 15th Jul, 2014 00:44
Score: 1
Posts: 14
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
If you are going to update MSXML 4.30.2100.0, don;t use Step 2 above which updates to 4.30.2114.0. Instead, get msxml4-KB2758694-enu.exe updates to 4.30.2117.0.
Was this reply relevant?
+0
-0
ManFromOz RE: update MSXML 4?
Member 15th Jul, 2014 09:06
Score: 17
Posts: 107
User Since: 6th Jun 2012
System Score: N/A
Location: AU
Same thing on my W7 x64 machines.

PSI 2 suggests I install from here - http://www.microsoft.com/en-us/download/details.as... - so, what's the answer?

Should we just ignore this update for now and hope Secunia sort it out???
Was this reply relevant?
+0
-0
ManFromOz RE: update MSXML 4?
Member 15th Jul, 2014 09:24
Score: 17
Posts: 107
User Since: 6th Jun 2012
System Score: N/A
Location: AU
Last edited on 15th Jul, 2014 09:26
@Maurice,

Just an FYI, I have just emailed Secunia support and will post the result should I hear from them before this thread gets locked. ;)
Was this reply relevant?
+1
-0
Maurice Joyce RE: update MSXML 4?
Handling Contributor 15th Jul, 2014 09:38
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Good idea. By interfering in Microsoft business Secunia have mudded the water.

It is important that MSXML 4 is up to date to version 4.30.2117.0.

https://secunia.com/blog/why-microsoft-xml-core-se...

Telling users to update to version 6 will NOT achieve this.

Secunia should stick to their Modus Operandi & NOT get involved in matters beyond their remit & scope.

https://1ncuig.bn1.livefilestore.com/y2pzpJl4giP32...



--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+5
-0
George Yves RE: update MSXML 4?
Member 15th Jul, 2014 14:30
Score: 0
Posts: 2
User Since: 9th Aug 2008
System Score: N/A
Location: N/A
I have Windows Vista Home Basic SP2 (Russian) with all the latest updates.

Today my PSI 3 showed me the following warning: http://i66.fastpic.ru/big/2014/0715/53/d98dc8ff85f...

I saw that MSXML 3 and 6 are also installed in my system: http://i66.fastpic.ru/big/2014/0715/30/03bded6a722...

These are the problem file's detailes: http://i65.fastpic.ru/big/2014/0715/ca/f119adba023...

My Windows Explorer shows that I have the following MSXML*.dll files: http://i66.fastpic.ru/big/2014/0715/27/2cca1c3783c...

My Revo Uninstaller shows the following MSXML installations in my system: http://i66.fastpic.ru/big/2014/0715/b6/d897c615b54...

I have read and re-read this thread but it is all about Windows 7 and 8. Could anybody tell me what should I do?
Was this reply relevant?
+0
-0
trocker RE: update MSXML 4?
Member 15th Jul, 2014 15:57
Score: 5
Posts: 12
User Since: 29th Nov 2011
System Score: N/A
Location: US
on 15th Jul, 2014 14:30, George Yves wrote:


I have read and re-read this thread but it is all about Windows 7 and 8. Could anybody tell me what should I do?


Since you have the latest version of msxml4 (4.30.2117.0) then my read of this thread is: you should ignore the PSI message; it seems to be a false positive.

Unfortunately, PSI 3 doesn't let you silence the notice on that file while still watching for future updates; it only lets you ignore all updates to a program (including future ones) or to have this one always alerting.
Was this reply relevant?
+1
-0
George Yves RE: update MSXML 4?
Member 15th Jul, 2014 16:01
Score: 0
Posts: 2
User Since: 9th Aug 2008
System Score: N/A
Location: N/A
on 15th Jul, 2014 15:57, trocker wrote:
Unfortunately, PSI 3 doesn't let you silence the notice on that file while still watching for future updates; it only lets you ignore all updates to a program (including future ones) or to have this one always alerting.

But what about PSI developers? I think they could do something from their end.
Was this reply relevant?
+0
-0
oklajohn RE: update MSXML 4?
Member 15th Jul, 2014 23:46
Score: 0
Posts: 9
User Since: 22nd Sep 2013
System Score: N/A
Location: US
Last edited on 15th Jul, 2014 23:49
I am choosing to "ignore" these on PSI - let MS advise me if I need update thru Windows Updates.
I have Windows 8.1 installed - upgraded from Windows 7 - that probably has something to do with this also, so it appears best just ignored in PSI for now.

--
Windows 8.1 X64
Windows Defender
MalwareBytes Pro
SuperAntiSpyware Pro
WinPatrol Pro

Was this reply relevant?
+0
-0
ManFromOz RE: update MSXML 4?
Member 16th Jul, 2014 02:26
Score: 17
Posts: 107
User Since: 6th Jun 2012
System Score: N/A
Location: AU
on 15th Jul, 2014 09:24, ManFromOz wrote:
@Maurice,

Just an FYI, I have just emailed Secunia support and will post the result should I hear from them before this thread gets locked. ;)


It seems that so far Secunia have chosen not to reply either here in the forums or to my email.
Was this reply relevant?
+0
-0
h.milner RE: update MSXML 4?
Member 16th Jul, 2014 07:00
Score: 0
Posts: 2
User Since: 6th Jun 2008
System Score: N/A
Location: AU
Meanwhile ...

@Maurice 14 July 2014
"If you do not like the red icon or want to show a 100% score just create an ignore rule. There is NO EVIDENCE that MSXML 4 SP3 (4.30.2117.0) is vulnerable therefore such an action is perfectly safe."

With PSI V3 right click the icon for Microsoft XML Core Services (MSXLMS) 4.x; check Details to be sure that the file is version 4.30.2117.0; close the pop-up; right click again and select ignore.

Thanks for your advice Maurice.
Was this reply relevant?
+0
-0
Leendert Kip update MSXML 4?
Contributor 16th Jul, 2014 08:12
Score: 137
Posts: 611
User Since: 22nd Jan 2009
System Score: N/A
Location: NL
I agree with Maurice and I too set v. 4 to ignore. I'm disappointed that Secunia support doesn't respond. That was much better in the past. It's very good to have Maurice and some other experienced members in the forum who can give us the advice we need.

--
PC: PWA Computers
Intel Core I3 2100 3.1Ghz
Kingston DDR3 ValueRam 4GB 1333
Kingston SSD SV300S 240GB
Windows 7 Home Premium 64bits SP1
Secunia PSI 3.0.0.11005
Internet Explorer 11
Mozilla Firefox 59.0.2NL
Google Chrome 66.0.3359.117

Laptop: MSI GT780DX
Intel Core I5-2450
DDR3 RAM 6GB
Windows 7 Home Premium 64bits SP1
Secunia PSI 3.0.0.11005
Internet Explorer 11
Mozilla Firefox 59.0.2NL
Was this reply relevant?
+2
-0
J.Vemmer RE: update MSXML 4?
Secunia Official 16th Jul, 2014 10:20
Score: 5
Posts: 20
User Since: 5th Oct 2011
System Score: N/A
Location: Copenhagen, DK
Hi,

Microsoft has announced that the widely used Microsoft XML Core Services (MSXML) 4.x has reached the end of its lifecycle. The announcement was made back in 2013 (http://support.microsoft.com/gp/msxmlannounce), stating that April 12th 2014 was the EOL date. This is further supported by the official Microsoft Lifecycle Policy found here: http://support.microsoft.com/lifecycle/search/defa...

As a result, all versions of Microsoft XML Core Services (MSXML) 4.x will correctly be flagged as EOL by the Secunia products, recommending an upgrade to Microsoft XML Core Services (MSXML) 6.x, as stated in the Microsoft announcement.

--
Kind regards,

Jais Vemmer
xSI Signatures Specialist
h.milner RE: update MSXML 4?
Member 16th Jul, 2014 13:11
Score: 0
Posts: 2
User Since: 6th Jun 2008
System Score: N/A
Location: AU
Thanks for the reply and advice.
I now have two questions:
1. How to remove the ignore rule which I created for MSXML 4? - Settings gives me 3 options none of which are relevant (Start on boot, Install updated automatically, and Scan individual drives)
2. Which files should I download and install from
http://www.microsoft.com/en-us/download/details.as...
I use Windows 7 Ultimate.
Should I download and install both msxml6.msi and msxml6_SDK.msi?
Was this reply relevant?
+0
-0
leskoonk RE: update MSXML 4?
Member 16th Jul, 2014 13:26
Score: 3
Posts: 5
User Since: 15th Jun 2010
System Score: N/A
Location: N/A
Thank you for your official response.

The problem which remains is that there is no possible action to take.

1.) One cannot "upgrade" to MSXML 6, as installing it leaves MSXML 4 (and 3) installed.

2.) There seems to be no way to uninstall MSXML 4

So, there is nothing one can do.

Please advise what the correct action is, as the suggestion to "upgrade" is not relevant.

Larry
Was this reply relevant?
+0
-0
Tholly RE: update MSXML 4?
Member 16th Jul, 2014 14:12
Score: 2
Posts: 10
User Since: 7th Nov 2010
System Score: N/A
Location: US
The best summary I have found on the status/history of MSXML# (# = 1,2,3, etc) is found in the Wiki >>

http://en.wikipedia.org/wiki/MSXML

In the above is the following quote >>

"Version 6, 4, and 3 may all be installed and running concurrently."

Sadly, this is the first time I have had to create an "ignore" rule for PSI.

Seems to me that merely being "End-of-Life" (EOL) is not grounds for issueing "should remove" and certainly not "should update to version 6" instructions. One's computer could have legacy programs that need version 4. My computer does not have MSXML5.dll resident and yet it is "current" ... but essentially an "internally" used version for Office 2003 and 2007. Interesting that version 3 remains current. On my computer is version 3 - SP11 ... even though the Wiki only references up to SP10. Here's some version 3 details (note that is was fairly recently updated!) >>

File description: MSXML 3.0 SP11
Type: Application extension
File version: 8.110.7601.18431
Date modified: 3/26/2014 9:27 AM

I do "love" PSI !

Would not be without it. Even in this case that caused me a few hours of work ... I learned some things. Just wish the false positive situation would be addressed and avoid others having to struggle chasing down the facts.


Was this reply relevant?
+0
-0
pfvincent RE: update MSXML 4?
Member 16th Jul, 2014 18:59
Score: 0
Posts: 7
User Since: 4th Oct 2008
System Score: N/A
Location: UK
Was this reply relevant?
+0
-0
pfvincent RE: update MSXML 4?
Member 16th Jul, 2014 19:02
Score: 0
Posts: 7
User Since: 4th Oct 2008
System Score: N/A
Location: UK
In response to h.milner's query on how to remove an ignore rule, if you select and right click on the rule you get options to Edit or Delete it.
Was this reply relevant?
+0
-0
henry8th RE: update MSXML 4?
Member 16th Jul, 2014 20:25
Score: 15
Posts: 19
User Since: 23rd May 2013
System Score: N/A
Location: US
I am really getting frustrated with this issue. Secunia, I thought, was software for non-power users to help keep programs with vulnerabilities updated.simply and easily. It usually works well, however, I am at a loss how to proceed other than wait for Secunia, who seems dug in to their position, and tech savvy contributors to sort this out. What I have done so far, as directed by the Secunia PSI scan was to click the PSI update link which took me to a Microsoft MSXML 6 update page. I selected download all and figured my system would only use the applicable selections. The download went quick, too quick. When I checked my programs there was no MSXML 6 listed in my programs. A restart and PSI rescan still shows MSXML 4.30.2217.0 as end of life. Secunia, there is nothing else, as an average user, that I can do to update this program and get rid of your end of life designation since your own directions do not work!! And I surely would not attempt to delete the MSXML programs listed not knowing the consequences to my system. Why are you offering a solution that does not work?? Are you working on a solution that does??

Question for Tech Savvy contributors: Should all of the following be left on my system?

MSXML 4.0 SP2 (KB927978) 4.20.9841.0
MSXML 4.0 SP2 (KB954430) 4.20.9870.0
MSXML 4.0 SP2 (KB973688) 4.20.9876.0
MSXML 4.0 SP3 Parser 4.30.2100.0
MSXML 4.0 SP3 Parser (KB2758694) 4.30.2117.0

Windows Vista 32 bit SP2
Toshiba Satellite P205 2 GB /320 GB


--
Mister P
Was this reply relevant?
+1
-0
rd52 RE: update MSXML 4?
Member 16th Jul, 2014 21:05
Score: 21
Posts: 80
User Since: 4th Dec 2008
System Score: N/A
Location: US
I ended up deleting it with Revo-ui-pro, also there was still part of it listed in the Windows Programs and Features, which I also deleted. Went into Sys WOW 64 and deleted the msxml4r.dll and msxml4.dll files. I then ran CCleaner registry and deleted any referenced files to msxml4. Ran Secunia, no more liabilities. Ran command prompt sfc /scannow to check registry integrity (it was clean). I have tried opening all my programs I can think of, and so far no problems. Might have been a photo program that I no longer use? If I do encounter a problem I'll delete the offending program and re-install it, but so far, I'm good.
Was this reply relevant?
+2
-0
trocker RE: update MSXML 4?
Member 16th Jul, 2014 21:06
Score: 5
Posts: 12
User Since: 29th Nov 2011
System Score: N/A
Location: US
on 16th Jul, 2014 20:25, henry8th wrote:

Question for Tech Savvy contributors: Should all of the following be left on my system?


My experience was: even after removing all the updates, I was left with the most recent msxml4.dll files. You will have to risk removing them by hand, knowing that this might silently break applications that depend on them.

The good news is: if something breaks, you can always reinstall the files if you saved a copy, or if you reinstall the application that broke.
Was this reply relevant?
+0
-0
leskoonk RE: update MSXML 4?
Member 16th Jul, 2014 21:09
Score: 3
Posts: 5
User Since: 15th Jun 2010
System Score: N/A
Location: N/A
Call me redundant:

It is far easier to just ignore the error. Clearly Secunia warning is bogus, EOL or not.

Larry
Was this reply relevant?
+2
-0
throkr. RE: update MSXML 4?
Contributor 17th Jul, 2014 13:42
Score: 139
Posts: 137
User Since: 22nd Nov 2009
System Score: N/A
Location: BE
Last edited on 17th Jul, 2014 13:47
on 16th Jul, 2014 21:05, rd52 wrote:
I ended up deleting it with Revo-ui-pro, also there was still part of it listed in the Windows Programs and Features, which I also deleted. Went into Sys WOW 64 and deleted the msxml4r.dll and msxml4.dll files. I then ran CCleaner registry and deleted any referenced files to msxml4. Ran Secunia, no more liabilities. Ran command prompt sfc /scannow to check registry integrity (it was clean). I have tried opening all my programs I can think of, and so far no problems. Might have been a photo program that I no longer use? If I do encounter a problem I'll delete the offending program and re-install it, but so far, I'm good.


I also deleted the flagged MSXML 4.0 item : Revo Uninstaller Pro, deletion of the remaining items in folder SYSWOW64, CCleaner and sfc /scannow. So far, no problem.

Let's wait and see ... Anyway,as mentioned, if a program needs it, a reinstallation is always possible ... or I will go back to an older system image ... ;-)



--
Win 10 Pro x64

Malwarebytes Premium - Windows Defender - SAS Pro - Flexera PSI
Cyberfox (x64) - Waterfox (x64) - SRWare Iron (x64)

- All current versions & updates -
Was this reply relevant?
+0
-0
jamesmanning RE: update MSXML 4?
Member 18th Jul, 2014 16:14
Score: 0
Posts: 3
User Since: 19th Jun 2013
System Score: N/A
Location: US
I had 4 entries for MSXML4 in add/remove programs (appwiz.cpl), and after removing all 4 and doing a rescan with PSI, the warning was gone.

Admittedly, it seems like an EOL for product that side-by-side their major versions like this should give the advice of "uninstall" instead of "update your latest version". msxml4 and msxml6 are effectively different libraries, so PSI should treat them as such, IMHO.

Also, not sure if this is a general PSI issue or not, but while I like having the 'update' option for things (like was in the options for msxml here), I would love to also have 'uninstall' options generally. Often times the thing that's being flagged as insecure is something I'm not using anymore, so while updating it to a secure version is one option, having the ability to uninstall it instead from the same context menu would be very helpful, especially for items that may not be easy to identify in the add/remove programs list (like msxml4 here, where the affected version was the 32-bit version in SysWOW64)

Thanks!
Was this reply relevant?
+0
-0
rusty.07 RE: update MSXML 4?
Member 18th Jul, 2014 19:31
Score: 16
Posts: 30
User Since: 18th Apr 2014
System Score: N/A
Location: US
Jais Vemmer, if this is the best you can do, please find another job.

Can someone give us some down-to-earth help on this matter?
Was this reply relevant?
+0
-1
inahut RE: update MSXML 4?
Member 19th Jul, 2014 19:12
Score: 9
Posts: 12
User Since: 19th Jul 2014
System Score: N/A
Location: US
Last edited on 19th Jul, 2014 19:15
I have researched this problem on my own
I have examined the information MS provides about differing versions of MSXML
Below I quote from a post made in one of the other threads about this Secunia-MSXML problem.
Also, do a forum search using MSXML to find any and all the help provided by Maurice Joyce, who is, in my reading of him and by following his MS links, the only voice here on this matter that is comprehensive:

"MS shows the differing versions are not directly incompatable
MS recommends installation of newest version
Newest version is 6.0
When one finds its exact location within Windows, one can see the versions listed in order, in my case as msxml3...4...6
The installation date I find for my msmxml6.dll and msxml6r.dll is 3-26-2014, as a result of MS update itself
I find the information provided by Maurice Joyce in this thread and in the thread titled "MSXML" to be more accurate than any information provided by Secunia voices
My research shows that Maurice Joyce in describing this problem in terms used by MS itself without leaving out any important variable or factor
In these threads the voices representative of Secunia are not reproducing the information provided by MS in a completely accurate way.
I have followed the links and read the information to the best of my abiltiy
When I encountered Maurice Joyce's synthesis of the information it rang true and help me see the error being produced by Secunia PSI is incorrect, erroneous and at this point in time it is quite aggravating."
Was this reply relevant?
+1
-0
inahut RE: update MSXML 4?
Member 19th Jul, 2014 19:22
Score: 9
Posts: 12
User Since: 19th Jul 2014
System Score: N/A
Location: US
It is not necessary to delete any earlier versions of MSXML, and is not recommended as long as one has the final versions of each number; somewhere someone else noted he needed an older version in order to use peripheral hardware (a scanner?) that required it.
My best information shows the earlier and the latest number iterations of MSXML are compatible with one another; again, as long as one has the latest update for each, which is something Windows Update has been doing for me since I originally installed the version of Windows I have been using since 2012.
Was this reply relevant?
+0
-0
inahut RE: update MSXML 4?
Member 19th Jul, 2014 19:30
Score: 9
Posts: 12
User Since: 19th Jul 2014
System Score: N/A
Location: US
And again
Obsessively
An Upgrade or Update to MSXML 6.x is something Windows Update will take care of for your Windows OS install
This upgrade or update does not call for us to uninstall any versions of MSXML prior to 6.x

Upgrade or update to a newer version of MSXML does not mean that the presence of any or all previous iterations of MSXML are a problem--they are supposed to be there if they are already there and it is not recommended that you believe Secunia's misunderstanding about this.
Was this reply relevant?
+1
-0
delraybuzz RE: update MSXML 4?
Member 19th Jul, 2014 21:28
Score: 1
Posts: 9
User Since: 6th Jan 2010
System Score: N/A
Location: US
After wasting 2 days searching, downloading (or rather attempting to upgrade!) researching etcetera, I have come to the conclusion Secunia is no longer as reliable as my PSI version used to be! Finally found a blurb in Microsoft stating that since this version is no longer being supported by Microsoft (part of Windows XP) there are no updates! Windows update has downloaded version 6 and is nicely taking care of keeping us updated! My time is too darn precious to waste this way, so I hope Secunia returns to better methods of research now!
I'm far from a techie, being way up in my 80's, but this unnecessary hunt was uncalled for!

--
never too old to learn!
delraybuzz
Was this reply relevant?
+1
-0

This thread has been marked as locked.