Forum Thread: Removing old instances of MSXML

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft XML Core Services (MSXML) 4.x

This thread has been marked as resolved.
Recruiter Removing old instances of MSXML
Member 17th Oct, 2014 17:11
Ranking: 1
Posts: 48
User Since: 18th Dec, 2008
System Score: N/A
Location: US
I downloaded and installed the latest MSXML6.dll and 6r.dll core services from Microsoft. According to Secunia, I still have, as my latest version, version 4.30.2117.0. When I checked the details, I discovered that I actually had under \Windows\System32\ a total of 6 XML files. MSXML3.dll and 3r.dll, MSXML4.dll and 4r.dll and MSXML6.dll and 6r.dll were listed.
How do I "safely" remove the old versions, or at least make them so they aren't recognized as the latest versions?
Thanks
Dave

Post "RE: Removing old instances of MSXML" has been selected as an answer.
Maurice Joyce RE: Removing old instances of MSXML
Handling Contributor 17th Oct, 2014 18:55
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Dave,
Are you still using Windows Vista? I would be very cautious when dealing with MSXML. Is PSI telling you that anything MSXML3 or MSXML6 is End of Life? Unlikely because these assets are managed by Microsoft.

It is normal to have multiple entries for MSXML - these are what I have on Windows 7 & 8.1

https://1ncuig-ch3302.files.1drv.com/y2plGntGfhENv...

Is your display different?

It should be telling you MSXML 4 is End of Life which is correct.


--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
kardmania RE: Removing old instances of MSXML
Member 18th Oct, 2014 03:40
Score: 1
Posts: 49
User Since: 7th Jun 2009
System Score: N/A
Location: N/A
I just got off the phone with Microsoft regarding this issue. The version 6 update recommended by Secunia seems to be designed for older versions of Windows only. Microsoft recommend doing nothing. Secunia and MS need to get together and determine what is the correct approach
Was this reply relevant?
+0
-0
Maurice Joyce RE: Removing old instances of MSXML
Handling Contributor 18th Oct, 2014 10:31
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I have no idea who you have contacted at Microsoft but they/you are talking absolute nonsense. The status of MSXML is VERY CLEAR.

MSXML6 & MSXML 3 are the latest versions & are part of Windows Vista,7,8 & 8.1. MSXML4 is not. This explains it all perfectly.

http://en.wikipedia.org/wiki/MSXML

A more detailed read is here or you can follow the references in the Wiki article.

http://msdn.microsoft.com/en-us/library/ms763742%2...

Secunia have muddied the waters by the method used to notify users that MSXML 4 is EOL. This thread gives a great deal of detail on the role Secunia played in this saga.

https://secunia.com/community/forum/thread/show/15...

Of course users must do something.

1. They must ensure that MSXML 6 & MSXML 3 are present & up to date on a Windows PC.

2. They must conduct a Risk Assessment on the impact of keeping the obsolete MSXML 4 on their PC & then choose an option:

a. Create an ignore rule which is risky knowing that Microsoft no-longer support it.

b. Rename the dll file.

c. Remove MSXML4 from the PC.

**** Actions b. & c. will of course cripple the old legacy programme this version of MSXML was supporting.




--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+2
-0
ddmarshall RE: Removing old instances of MSXML
Dedicated Contributor 18th Oct, 2014 19:03
Score: 1250
Posts: 992
User Since: 8th Nov 2008
System Score: N/A
Location: UK
Is there no way to convince Secunia that linking to a download of MSXML 6.0 for Windows XP as a putative solution to MSXML 4.0 being EOL is a bad idea? Otherwise this question will just keep recurring.

--
Was this reply relevant?
+0
-0
Recruiter RE: Removing old instances of MSXML
Member 18th Oct, 2014 20:19
Score: 1
Posts: 48
User Since: 18th Dec 2008
System Score: N/A
Location: US
Maurice:
Yes, I am still using Vista. PSI shows that MSXML3 and MSXML 6 are up to date. It continues to request an update for MSXML4 vs End of Life.
Dave
Was this reply relevant?
+0
-0
Maurice Joyce RE: Removing old instances of MSXML
Handling Contributor 18th Oct, 2014 21:25
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Dave,
Thank you. You require MSXML 3 & 6 - they are managed by Microsoft via Windows Update. My advice is to leave those files alone.

MSXML 4 is different. It is not native to Vista which means you must have (or have had) a programme(s) installed that was reliant on it to work.

The version number of MSXML 4 you have installed was NOT vulnerable as at 14th April 2014 when it was declared End of Life by Microsoft. They will not issue any further updates for it so, on that basis you really have 4 options.

1. Do nothing & let Secunia keep nagging you with irrelevant information on what to do****

2. After a risk assessment, create an ignore rule within PSI to stop the nagging.

3. Rename the offending files.

4. Uninstall MSXML4.

If you complete 3. or 4. it will of course cripple any OLD programme(s) reliant on MSXML 4.

If you have no idea what programme(s) are reliant my advice would be to rename the files because:

1. Any programme(s) reliant on it would send out an error message so that you can make a better assessment on what to do.

2. The renaming action can easily be reversed.

3. It negates any security concerns until you finally decide to uninstall or create an ignore rule.

Hope this helps. I can write a simple script if you decide to rename MSXML4 & are unsure on the actions required.

**** Please take no notice of the advice offered by Secunia via PSI. Pure fiction.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
Recruiter RE: Removing old instances of MSXML
Member 19th Oct, 2014 18:22
Score: 1
Posts: 48
User Since: 18th Dec 2008
System Score: N/A
Location: US
Thanks Maurice:
I think the renaming would be the best option, since I have no idea what, if any, programs are using MSXML4.
I am not sure how to do the renaming. Do I simply rename the files MSXML4.dll.old and MSXML4r.dll.old, or do I need to create a script for the renaming?
Thanks
Dave
Was this reply relevant?
+0
-0
Maurice Joyce RE: Removing old instances of MSXML
Handling Contributor 19th Oct, 2014 19:32
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Dave,
You are absolutely correct. Just right click on each file>select rename & add .OLD on the end like this.

https://1ncuig.bn1.livefilestore.com/y2plmeVs8NDLB...

After a full PSI rescan it should not show.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+1
-0

Maurice Joyce

RE: Removing old instances of MSXML
[+]
This reply has been deleted
Recruiter RE: Removing old instances of MSXML
Member 19th Oct, 2014 22:41
Score: 1
Posts: 48
User Since: 18th Dec 2008
System Score: N/A
Location: US
Thanks Maurice:
PSI no longer shows MSXML4 as needing updating. Now all I have to do is sit back and see if anything gives me trouble without it. Probably not. It was probably something I downloaded with a program a long time ago, and don't even use anymore. Time will tell.
Thanks
Dave
Was this reply relevant?
+1
-0

This thread has been marked as locked.