Forum Thread: Microsoft .NET Framework 2.x erroneously declared EOL

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
PSI

This thread has been marked as locked.
colebantam Microsoft .NET Framework 2.x erroneously declared EOL
Member 31st Mar, 2017 15:55
Ranking: 23
Posts: 21
User Since: 23rd Apr, 2010
System Score: N/A
Location: AT
Hello there,

I just scanned my Windows 8.1 System and PSI declared the Microsoft .NET Framework 2.x EOL. This is, in this case, wrong! Microsoft says in their Lifecycle Policy for .NET, that Frameworks that are part of the OS are treated as "Components" rather separate products, thus having the same Support Policy then the Host-OS. In my case, the embedded .NET 2 is part of the .NET 3.5 Operating System Component and thus still has support. Please adjust detection of PSI accordingly, so that Non-Pro-customers don't get frightened unnecessarily.

throkr. RE: Microsoft .NET Framework 2.x erroneously declared EOL
Contributor 31st Mar, 2017 19:16
Score: 128
Posts: 125
User Since: 22nd Nov 2009
System Score: 100%
Location: BE
Last edited on 31st Mar, 2017 19:17
Hi,

You can easy explain this directly to Flexera through the PSI. In version 3, click on "Add Program" in the upper right corner of the detected programs list, fill in (if possible) all the fields and your request in the additional info box.
This works and is the fastest way; I have done it this way a few times and even if my request didn't concern a new program or a major update, they've always answered within 24 hs (as usual).

Hope this helps.

--
Win 10 Pro x64

Malwarebytes Premium - Windows Defender - SAS Pro - Shadow Defender (on demand) - Secunia PSI (3.0.0.11005)
Cyberfox (x64) - SRWare Iron (x64)

- All current versions & updates -
Was this reply relevant?
+0
-0
colebantam RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 31st Mar, 2017 19:27
Score: 23
Posts: 21
User Since: 23rd Apr 2010
System Score: N/A
Location: AT
I submitted the Info via PSI (add programm link...).
Was this reply relevant?
+0
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 1st Apr, 2017 14:36
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
on 31st Mar, 2017 19:27, colebantam wrote:
I submitted the Info via PSI (add programm link...).

---

Do have any new information? Did you get any response by Secunia, yet?

- regards
Klaus
Was this reply relevant?
+0
-0
colebantam RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 1st Apr, 2017 14:42
Score: 23
Posts: 21
User Since: 23rd Apr 2010
System Score: N/A
Location: AT
Sadly not. No Feedback from Secunia so far...

MfG, Claus
Was this reply relevant?
+0
-0
Leendert Kip Microsoft .NET Framework 2.x erroneously declared EOL
Contributor 1st Apr, 2017 15:26
Score: 118
Posts: 600
User Since: 22nd Jan 2009
System Score: 100%
Location: NL
Hi Claus, Secunia support doesn't work in the weekend. Requests for adding programs are always handled and confirmed by mail. Expect a reply monday.

--
PC: PWA Computers
Intel Core I3 2100 3.1Ghz
Kingston DDR3 ValueRam 4GB 1333
Kingston SSD SV300S 240GB
Windows 7 Home Premium 64bits SP1
Secunia PSI 3.0.0.11005
Internet Explorer 11
Mozilla Firefox 56.0.1NL
Google Chrome 62.0.3202.62
163.100

Laptop: MSI GT780DX
Intel Core I5-2450
DDR3 RAM 6GB
Windows 7 Home Premium 64bits SP1
Secunia PSI 3.0.0.11005
Internet Explorer 11
Mozilla Firefox 56.0NL
Was this reply relevant?
+1
-1
DJDTHS RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 3rd Apr, 2017 17:59
Score: 0
Posts: 4
User Since: 20th Sep 2013
System Score: N/A
Location: US
on 1st Apr, 2017 15:26, Leendert Kip wrote:
Hi Claus, Secunia support doesn't work in the weekend. Requests for adding programs are always handled and confirmed by mail. Expect a reply monday.

Hoped there would have been a reponse from Flexeera/Secunia today.
Was this reply relevant?
+0
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 3rd Apr, 2017 18:39
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
Last edited on 3rd Apr, 2017 18:56
... as Maurice Joyce mentioned inside this thread (25th Mar, 2017 17:35):

https://secuniaresearch.flexerasoftware.com/commun...

"..based on this thread it looks like Flexera Support are no different to the old Secunia - extremely arrogant, boastful about their status in the vulnerability world, economic with precise detail and rude in not answering valid questions."


May be, we should simly ignore the EOL-message. Because some third-party-software could have installed .NET 2.x along with .NET 4.x.
So you can't replace .NET 2.x by .NET 3.x. The link PSI 3.0 gives seems to be nonsense.

-regards
Klaus

Was this reply relevant?
+1
-0
Spiff RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 3rd Apr, 2017 18:59
Score: 19
Posts: 45
User Since: 22nd Dec 2010
System Score: N/A
Location: NL

Like colebantam [post #3], I contacted Flexera support via the PSI "add program" option.

Today, I received Flexera support's reply:

-----
The vendor states [1], that "...beginning with .NET Framework 3.5 Service Pack 1 (SP1), the .NET Framework is defined as a component instead of an independent product. As a component, .NET Framework version 3.5 Service Pack 1 (SP1) or later versions assumes the same Lifecycle Policy as its underlying Windows operating system on which it is installed.". As version 2.x predates version 3.5 SP1, it is considered an independent product, as defined by the vendor.

As this information is corroborated by the vendor's support lifecycle [2] ("Support for .NET Framework 2.0 ended on July 12, 2011. .NET 3.5 SP1 is the only supported service pack level after this date."), we consider this version EOL.

[1] https://support.microsoft.com/en-us/help/17455/lif...
[2] https://support.microsoft.com/en-us/lifecycle/sear...
-----


Regarding my Windows 7 x64 system, I replied:

-----
In the Windows 7 operating system,
with Microsoft.NET Framework 4.6.2 installed,
and with no Microsoft.NET Framework 2.x or Microsoft.NET Framework 3.5 installed,
Microsoft.NET Framework 2.0.x, 3.0, 3.5 and 4.0.x files are all part of
C:\Windows\Microsoft.NET\Framework
and C:\Windows\Microsoft.NET\Framework64

I'm not sure if the Microsoft.NET Framework 2.0.x, 3.0, 3.5 and 4.0.x files and folders are part of the Windows 7 operating system, or part of the installed Microsoft.NET Framework 4.6.2, but they are all inseparable parts of the installation and cannot be uninstalled or updated separately.

In installations in which Microsoft.NET Framework 2.x is an independent product that can be uninstalled or updated separately, Microsoft.NET Framework 2.x is EOL.
This may be the case for Windows versions prior to windows 7, I do not know about that.

But where Microsoft.NET Framework 2.x is an inseparable part of the Windows 7 operating system, or an inseparable part of the installed Microsoft.NET Framework 4.6.2, it cannot be considered EOL.

Please, have a look at the Windows 7 x64 file system with Microsoft.NET Framework 4.6.2 installed,
and please reconsider the EOL designation for Microsoft.NET Framework 2.x (x86 and x64) in Windows 7 with Microsoft.NET Framework 4.6.2, and also for similar installations.
-----


If there's any new response from Flexera support, I'll post in this thread.


Was this reply relevant?
+1
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 3rd Apr, 2017 22:35
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
@Maurice Joyce

Maurice,

is it also valid here what you mentioned today (21:48) in this thread, already:
https://secuniaresearch.flexerasoftware.com/commun...

Then I tend to ignore the declared EOL of .NET Framework 2.x ...

P.S: how can refer to a post in another thread..?

- regards
Klaus
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft .NET Framework 2.x erroneously declared EOL
Handling Contributor 3rd Apr, 2017 22:44
Score: 12287
Posts: 9,543
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Klaus,
Are you referring to my comment about .NET Framework?

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1709 (Creators Update) Build 16299.19
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 3rd Apr, 2017 22:58
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
Maurice,

yes, I do.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft .NET Framework 2.x erroneously declared EOL
Handling Contributor 3rd Apr, 2017 23:32
Score: 12287
Posts: 9,543
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 3rd Apr, 2017 23:33
I am not affected by what looks to me as a false positive. Flexera are using the same kind of argument that they did in the MSXML 4 saga.

I would do nothing until @colebantam and @spiff report back.

I am a bystander but If affected I to would challenge the reply given to date.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1709 (Creators Update) Build 16299.19
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
rd52 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 00:01
Score: 21
Posts: 78
User Since: 4th Dec 2008
System Score: N/A
Location: US
I have the offending MS.NET Framework 2 on my Windows 10 computer. I tried to delete it but was unable to. After reading on the web it seems that all the NET.Framework versions seem to be interconnected with one another. In the meantime I have selected the "ignore updates to this program" in the meantime.

In my case Secunia is almost no longer needed, been using it for years, but with Windows 10 updating Flash automatically, and Chrome constantly updating it Secunia is almost to the point of me not needing it. As of now I have flash disabled in all my browsers except Chrome, and in Chrome it is only allowed "on demand".

My other reason for this post is I'd like to receive the emails when this thread is updated.
Was this reply relevant?
+0
-0
Spiff RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 14:51
Score: 19
Posts: 45
User Since: 22nd Dec 2010
System Score: N/A
Location: NL
Last edited on 4th Apr, 2017 14:54
on 3rd Apr, 2017 18:59, Spiff wrote:
[...]
If there's any new response from Flexera support, I'll post in this thread.
-----


Here's the new reply from Flexera support.

Flexera support replied:

-----
Thank you for getting back to us.

Microsoft .NET Framework 2.x is End-of-Life (EOL) according to the vendor.

The vendor has bundled an old version of this software within later versions of Microsoft .NET Framework (starting with Microsoft .NET Framework 3.5). Due to the way they have bundled this, we cannot detect the difference.

However, Microsoft .NET Framework 2.x will not receive any security updates for vulnerabilities found within it, which is consistent with what we consider EOL. Microsoft may release patches for the operating system that includes these later versions of Microsoft .NET Framework, fixing vulnerabilities in itself or any component they bundled, in this case, the Microsoft .NET Framework 2.x, though it is not certain.

It is also currently unclear whether vulnerabilities found within the standalone version of Microsoft .NET Framework 2.x can be exploited in the bundled version. Therefore, we have chosen to ensure that people who may be insecure will be flagged as such, rather than leave them insecure. While this may lead to an odd display for people who have the bundled version installed, we chose to weigh the security of users higher than a display oddity. Until Microsoft change the way they bundled the product, there is sadly nothing we can about it.

We of course encourage you to contact them and ask them to change the bundling, though it seems unlikely that they will introduce radical changes to such an old component.
-----


To which I replied:

-----
Thank you very much for your reply and for the extensive clarification, it is much appreciated.

Your clarification was very helpful.
I understand the problem, and I understand Flexera's policy.

The only issue now is that less computer knowledgeable users may not understand that a bundled Microsoft .NET Framework 2.x cannot be updated, while PSI 3.0 says it is EOL, mentions 3.x as a safe option and offers a "Click to update" option.
This will probably confuse and worry less computer knowledgeable users, which I think is very unfortunate. But I see no simple solution to that.


Thanks very much once again.
-----


And I suppose that's it.


Was this reply relevant?
+2
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 15:05
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
@Spiff
Wouldn't it be a kind of simple solution if Flexera would exactly do what they state here (3rd page):
https://secuniaresearch.flexerasoftware.com/?actio...

"The Secunia PSI is a free security scanner that identifies vulnerabilities in 3rd party (non-Microsoft programs, which can expose PCs to attacks."

Microsoft .NET Framework 2.x may be bundled with later versions of .NET framework or installed alone: it remains a Microsoft program!
And therefore it is no 3rd party software.

May be we should keep in mind this:
on 3rd Apr, 2017 23:32, Maurice Joyce wrote:
I am not affected by what looks to me as a false positive. Flexera are using the same kind of argument that they did in the MSXML 4 saga.

I would do nothing until @colebantam and @spiff report back.

I am a bystander but If affected I to would challenge the reply given to date.


. regards
Klaus
Was this reply relevant?
+1
-0
Spiff RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 15:28
Score: 19
Posts: 45
User Since: 22nd Dec 2010
System Score: N/A
Location: NL

Hi Klaus,

Although the product sheet says differently, PSI has always scanned for vulnerabilities in Microsoft programs as well.
Not only .NET Framework, but also Internet Explorer, Windows Media Player, and many more Microsoft programs and components - even the Windows operating system.
I don't think Flexera will change that because the product sheet says differently.
However on option not to scan Microsoft programs could be an idea.

Was this reply relevant?
+1
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 15:41
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
Last edited on 4th Apr, 2017 15:54
Spiff,

I agree.

on 4th Apr, 2017 15:28, Spiff wrote:

However on option not to scan Microsoft programs could be an idea.


This is the way SUMo (mentioned here https://secuniaresearch.flexerasoftware.com/commun...)
is working..

EDIT
Possibly another way: on my computer the service "Microsoft .NET Framework NGEN v2.0.50727_X64" is deactivated.
Perhaps PSI should look for this...

- regards
Klaus

Was this reply relevant?
+0
-0
TimmiAndi RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 16:43
Score: 0
Posts: 18
User Since: 17th Jul 2009
System Score: 100%
Location: UK

I don't have much technical knowledge but it seems Net 2.X is EOL and won't get security patches, it can't be deleted and can't be replaced by downloading 3.5 or later, so I have to live with it.

Is that right or is there something I can do to change things?

--
Tim
Win 7 Pro 32 Bit, V 6.1; SP1
Excel 2016, Rest of Office Suite 2010
Was this reply relevant?
+0
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 16:54
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
Tim,

due to the fact that Flexera is not willing to change anything it's up to you to decide. I think you can ignore it or you can live with it.

- regards
Klaus
Was this reply relevant?
+0
-0
colebantam RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 17:03
Score: 23
Posts: 21
User Since: 23rd Apr 2010
System Score: N/A
Location: AT
Last edited on 4th Apr, 2017 17:06
OK. I finally got an "final" answer from Secunia, after I got back on them two times. But lets make it easier to read for others:
-------------------------

-- Users who can safely ignore the PSI rating for .NET 2.x --
1.) Users who have activated the .NET Components delivered with their OS.
2.) Users who have installed Microsoft .NET 3.5 SP1

-- Users who really have an EOL .NET 2.x --
Users who have installed Microsoft .NET BEFORE version 3.5 SP1 as a separate Install (not as a OS Component).

-- Why does Secunia display .NET 2 as EOL, when even when it's not? --
They say its not possible to distinguish between the .NET 2.x Runtime thats bundled with the OS or .NET 3.5 SP1 and the standalone v2 Package. We can believe that or not, I guess it won't make a difference :/ So we have that silly situation, where lots of users will be frightened for no reason, and Secunia/Flexera says, that its better to fright them, then no to inform those who really have an EOL .NET 2 Installation.

-- Where have u gotten your information from --
Its all on the Microsoft Support Lifecycle Site. With .NET its really a bit confusing, because there are several sources that seems to ignore each other, but once you read it all, it makes sense. The best page to read is this, because it clarifies the situation with bundled and standalone versions of .NET: https://support.microsoft.com/kb/2696944
More Info on .NET Support Lifecycle: https://support.microsoft.com/en-us/help/17455/lif...

-- Conclusion --
Well, its sad that Secunia is making it hard for users as it needs to be, but seems like we have to live with that situation. Of course Users of the OS Component Version can try to uninstall the whole .NET 3.5 Component and have a look if any software doesn't run afterwards. If its OK without, you have a clean Secunia Result ;) Otherwise, simply hide it from the results, if its a OS Component or part of an still supported Bundle.

Regards, Claus
Was this reply relevant?
+3
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 19:48
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
Claus,

thanks a lot for making yourself so much trouble.

- regards
Klaus
Was this reply relevant?
+0
-0
CraigS26 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 4th Apr, 2017 23:51
Score: 6
Posts: 23
User Since: 8th Nov 2009
System Score: N/A
Location: US
Last edited on 4th Apr, 2017 23:55
Otherwise, simply hide it from the results, if its a OS Component or part of an still supported Bundle.

Win 7-64 Hm Prem .......I "Hid" a 2.x(64bit) Framework line and a 2.x line - AND - I RENAMED the TWO .dlls associated with the XML Core Svcs 4.30.2117 to ...... [ msxml4.OLD.dll ] and [ msxml4r.OLD.dll ]... ( for me in C:\Windows\SysWOW64 )... PSI 3 no longer sees them to scream about. I hope John (macko1944) in his Closed SQL/XML Core Svcs 4.x Thread did this, as well.

Went from 97% to 100% and no smoke in the computer yet.

PSI 3 doing OK after startup hiccups.

--
Win 7-64 Hm Prem - i5 8G - FF / IE 11 - ESET ESS - MBAM Pro + Anti-Exploit Prem - SuperAS Pro - Macrium Reflect - DK Pro '15 - PSI 3 - EPIM MAIL - No Flash or Java
Was this reply relevant?
+0
-0
jckinnick RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 02:59
Score: 6
Posts: 191
User Since: 21st May 2010
System Score: 100%
Location: US
So our best bet is to ignore this update?
Was this reply relevant?
+0
-0
Spiff RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 11:08
Score: 19
Posts: 45
User Since: 22nd Dec 2010
System Score: N/A
Location: NL
Last edited on 6th Apr, 2017 11:10
on 6th Apr, 2017 02:59, jckinnick wrote:

So our best bet is to ignore this update?
-----

If Microsoft .NET Framework 2.x is not displayed in Windows Control Panel\ Programs\ Uninstall a program, so it is not a standalone version of Microsoft .NET Framework 2.x, but instead it is a component of a supported Microsoft .NET Framework version, yes, PSI's EOL designation for Microsoft .NET Framework 2.x can be ignored.

Was this reply relevant?
+0
-0
colebantam RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 11:21
Score: 23
Posts: 21
User Since: 23rd Apr 2010
System Score: N/A
Location: AT
Hello Spiff and jckinnick,

It sadly is not that easy to detect as Spiff wrote :/

Even if you don't have .NET Framework 2.x in "Programs and Features" it can still be an EOL version. Its because .NET 3.0 and .NET 3.5 (without SP1) also bundle the v2 Runtimes, but both are EOL!
Was this reply relevant?
+1
-0
colebantam RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 11:37
Score: 23
Posts: 21
User Since: 23rd Apr 2010
System Score: N/A
Location: AT
Hello All,

I maybe found a bloody simple solution to detect if it's a "bad" or "good" version of .NET 2 on the system, but since I don't have much time for research at the moment, I could need some people doing short tests:

-- My guess --
If I'm right, one CANNOT install an ancient version of .NET on Windows 8.1 (I come to Win7 later). As far as I remember, whenever one tries to install a application that needs .NET 2, 3 or 3.5, Windows 8.1 enables the System Component and does NOT install the standalone version. So if that's true, the detection on Win8.1 would be easy as can be: If OSVersion = 8.1 -> .NET 2, 3 and 3.5 are safe!

-- Win 7 --
I'm not using ancient Win7 anymore, so I don't have it on my mind how Win7 behaves when someone wants to install .NET 2, 3 or 3.5. Can someone do some tests trying to install those 3 Applications and post back the results?

-- Testers wanted --
Can someone test installations of .NET 2, 3 and 3.5 on Win7, 8.1 and 10?

If I'm right with 8.1 and Win7 also refuses to install separate versions of .NET 2-3.5 we should be able to convince Secunia to add some more clever detection rules. Even if Win7 is not that advanced, people on 8.1 and 10 would benefit from this rules.

Greets, Claus
Was this reply relevant?
+1
-0
Spiff RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 11:55
Score: 19
Posts: 45
User Since: 22nd Dec 2010
System Score: N/A
Location: NL

Thank you very much for your correction to my previous post, colebantam.
You are right, of course.
I should have worded more careful. I should've said:

If Microsoft .NET Framework 2.x is not displayed in Windows Control Panel\ Programs\ Uninstall a program,
nor is .NET Framework 3.0,
nor is .NET Framework 3.5 without SP1,
so .NET Framework 2.x is not a standalone version of Microsoft .NET Framework 2.x,
nor is it a component of .NET Framework 3.0,
nor is it a component of .NET Framework 3.5 without SP1,
but instead .NET Framework 2.x is a component of a supported Microsoft .NET Framework version,
in that case, yes, PSI's EOL designation for Microsoft .NET Framework 2.x can be ignored.


And thank you very much for your later post, with your ideas regarding detecting if it's a 'bad' or 'good' version of .NET 2.
If people would be interested in testing your ideas, I think everyone would be interested in the outcomes.
Even Flexera itself could do those tests, if they wanted, I would think.

You said, "If I'm right with 8.1 and Win7 also refuses to install separate versions of .NET 2-3.5 we should be able to convince Secunia to add some more clever detection rules."
That would be great, but I'm not sure that PSI can handle clever detection rules. But perhaps I'm too pessimistic about PSI's detection algorithms.

Was this reply relevant?
+0
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 17:08
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
Spiff,

I just looked in my PC (Win 7 prof. 64 bit).

Neither Microsoft .NET Framework 2.x is displayed in Windows Control Panel\ Programs\ Uninstall a program,
nor is .NET Framework 3.0, nor is .NET Framework 3.5 without SP1.

I can only find Microsoft .NET Framework 4.5.2 in Windows Control Panel\ Programs.

Then I run "services.msc". It is shown:
Microsoft .NET Framework NGEN v2.0.50727_X64 start-type = Disabled
Microsoft .NET Framework NGEN v2.0.50727_X86 start-type = Disabled
Microsoft .NET Framework NGEN v4.0.30319_X64 start-type = Automatic
Microsoft .NET Framework NGEN v4.0.30319_X86 start-type = Automatic

From that I conclude, Microsoft .NET Framework 2.x as a standalone version may have been installed in past and may
have been necessary in the past. But now, it is not used anymore: I ignored the flagging.

Hope that helps.

- regard
KLaus
Was this reply relevant?
+0
-0
Spiff RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 18:06
Score: 19
Posts: 45
User Since: 22nd Dec 2010
System Score: N/A
Location: NL
Last edited on 6th Apr, 2017 18:15

@klausus02,

My system resembles yours.
Windows 7 pro SP1 x64 with Microsoft .NET Framework 4.6.2 installed.
Only Microsoft .NET Framework 4.6.2 is shown in Windows Control Panel\ Programs\ Uninstall a program,
services are the same as on your system.

A standalone version of Microsoft .NET Framework 2.x was never installed on my system,
nor was a standalone version of Microsoft .NET Framework 2.x included in Windows 7, according to Wikipedia.
According to Wikipedia, Microsoft .NET Framework 3.5 was included in Windows 7. On my system it was replaced by a later version.
https://en.wikipedia.org/wiki/.NET_Framework_versi...
(I'm sorry, I don't have time to research Wikipedia's references and other sources, now.)

Therefore, for my Windows 7 system, I assume the Microsoft .NET Framework 2.x files and folders in C:\Windows\Microsoft.NET\Framework and C:\Windows\Microsoft.NET\Framework64 and also the Microsoft .NET Framework NGEN v2.x services are components of Microsoft .NET Framework 4.6.2.
(And on your system probably of Microsoft .NET Framework 4.5.2.)

Was this reply relevant?
+0
-0
colebantam RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 18:22
Score: 23
Posts: 21
User Since: 23rd Apr 2010
System Score: N/A
Location: AT
Last edited on 6th Apr, 2017 18:24
@Klausus and Spiff:
.NET 2.x Runtimes are part of the 3.5 SP1 Package that is (according to Klausus) part of Win7 SP1.

.NET 2 Runtimes have nothing to do with the .NET 4.x Packages!

If you want to get rid of .NET 2 Runtimes, you have to disable the .NET 3.5 OS Component via "Control Panel -> Software -> Activate or deactivate Windows Features" (translated from German, real path may differ on English systems). But be aware that Apps that need .NET 2 or 3 Services will fail to run if the 3.5 Package is uninstalled!
Was this reply relevant?
+0
-0
Spiff RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 18:41
Score: 19
Posts: 45
User Since: 22nd Dec 2010
System Score: N/A
Location: NL
Last edited on 6th Apr, 2017 18:43

@colebantam,

On my mentioned system, no Microsoft .NET Framework 3.5 component is available in "Control Panel\ Programs\ Uninstall or change a program".
Nevertheless, Microsoft .NET Framework 2.x files and folders are in C:\Windows\Microsoft.NET\Framework and C:\Windows\Microsoft.NET\Framework64 and in Services there are the Microsoft .NET Framework NGEN v2.x services (Disabled).
That is why I assume what I mentioned in my previous post.
If my assumption was wrong, then the Microsoft .NET Framework 2.x components must be remnants of Microsoft .NET Framework 3.5 that was replaced by (on my system) Microsoft .NET Framework 4.6.2.

Was this reply relevant?
+1
-0
colebantam RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 19:02
Score: 23
Posts: 21
User Since: 23rd Apr 2010
System Score: N/A
Location: AT
Last edited on 6th Apr, 2017 19:06
@Spiff:

on 6th Apr, 2017 18:41, Spiff wrote:
On my mentioned system, no Microsoft .NET Framework 3.5 component is available in "Control Panel\ Programs\ Uninstall or change a program".


As I have written before, the OS-Component is NOT in "Control Panel\ Programs\ Uninstall or change a program" but in "Control Panel\ Programs\ Turn Windows features on or off" (this time I have looked for the right english names).

YouTube Tutorial:
https://www.youtube.com/watch?v=_At8B1KqjKg
(Goto 1:15 for Windows 7)
Was this reply relevant?
+2
-0
Spiff RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 19:39
Score: 19
Posts: 45
User Since: 22nd Dec 2010
System Score: N/A
Location: NL
on 6th Apr, 2017 19:02, colebantam wrote:

As I have written before, the OS-Component is NOT in "Control Panel\ Programs\ Uninstall or change a program" but in "Control Panel\ Programs\ Turn Windows features on or off" (this time I have looked for the right english names).
[...]
-----

Ah, thank you very much.
I am very sorry!
I overlooked the fact that you did not refer to "Uninstall or change a program", but to "Turn Windows features on or off".
There is no excuse for my mistake, not even the fact that first you translated as "Activate or deactivate Windows Features".
I should have paid more attention.

Anyhow, yes, there it is, in Windows 7, in "Turn Windows features on or off": Microsoft .NET Framework 3.5.1.
I should have thought of that, and I should've paid more attention.

But as you said, applications that need .NET 2 or 3 services will fail to run if Microsoft .NET Framework 3.5 is disabled in "Turn Windows features on or off", so I will leave Microsoft .NET Framework 3.5.1 enabled.

Thank you very much once again
and my apologies for not paying attention.



Was this reply relevant?
+1
-0
klausus02 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 20:18
Score: 91
Posts: 141
User Since: 4th Feb 2011
System Score: N/A
Location: DE
Last edited on 6th Apr, 2017 20:18
@all
... have look here:
https://secuniaresearch.flexerasoftware.com/commun...

Flexera/Secunia has changed the mind...

@Maurice Joyce
Did you ever experienced something like this?

-regards
Klaus
Was this reply relevant?
+2
-0
rd52 RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 21:24
Score: 21
Posts: 78
User Since: 4th Dec 2008
System Score: N/A
Location: US
I am on Windows 10 pro, which had been upgraded from W 7 pro. I did the unchecking of Net Framework 3.5 in the 'Turn Windows features on or off' as had been suggested in this thread. Right after I did it, I saw klausus02's post saying Secunia has now reversed their position. So far I haven't come across an app on my computer that needs the offending NET Framework 3.5. Ran a SFC scan, and all was OK. Little PO'd that it took Secunia till finally reach the new decision.

Anyway I just wanted to say thanks to all who posted here for their help.
Was this reply relevant?
+0
-0
Anthony Wells RE: Microsoft .NET Framework 2.x erroneously declared EOL
Expert Contributor 6th Apr, 2017 22:17
Score: 2539
Posts: 3,401
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

Hello All ,

If it helps , then the PSI reads the software metadata to determine the file string and version number . It cannot "see" if the software has a work around or whether it's state is enabled or not ; it will of course respond to a renamed file . Looking in File Explorer , all the versions on my W10 seem to be in the same holding Folder which is likely the Secunia diagnostic problem .

Whether they have found a alternate way to isolate the .NET 2.x folder as all your splendid efforts have explained or decided that the stand- alone is of limited exposure and returned to their own rule of non-display of embedded patch problems : who can say .

Despite the "criticisms" currently extant , Support are pretty good at rectifying their display problems where/whenever possible . Their one problem seems to be their update info/suggestions on M$/Windows updates ; they use the embedded IE engine and M$/Windows updates to connect to their servers and run the scans : remember the GUI on your machine is just that , no more .

If you want to know the Secunia/Flexera reasoning , I suggest you go back to your earlier email contacts .

Take care

Anthony



--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+1
-0
colebantam RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 6th Apr, 2017 22:27
Score: 23
Posts: 21
User Since: 23rd Apr 2010
System Score: N/A
Location: AT
It's no longer detected EOL on my PC too now :)
Glad to see, that Secunia IS listening to us - somehow - sometimes ;)
Was this reply relevant?
+1
-0
SteveSecunia RE: Microsoft .NET Framework 2.x erroneously declared EOL
Member 13th Apr, 2017 00:46
Score:
Posts: 1
User Since: 19th Dec 2009
System Score: N/A
Location: US
Last edited on 13th Apr, 2017 00:49
April, 2017 Security and Quality Roll up for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows 7 (KB4014981)

Installation date: ‎4/‎11/‎2017 4:11 PM

Installation status: Successful

Update type: Important

https://support.microsoft.com/en-us/help/4014981/s...

This update fixes the false positve EOL in windows 7 SP1 32-Bit Hope this helps.
Was this reply relevant?
+0
-0

This thread has been marked as locked.