1

So, I was just reviewing my workstations for software they're not supposed to have, and came across traces of MSXML 4.0 still being on some of my machines.

These are all Windows 7 machines, they had MSXML 4.0 installed on them and I issued the following commands to remove it:

Uninstall MSXML 4.0 SP2 (KB954430) 4.20.9870.0: 

%windir%\System32\msiexec.exe /x {86493ADD-824D-4B8E-BD72-8C5DCDC52A71} /qn /norestart

Uninstall MSXML 4.0 SP2 (KB973688) 4.20.9876.0: 

%windir%\System32\msiexec.exe /x {F662A8E6-F4DC-41A2-901E-8C11F044BDEC} /qn /norestart

(These were the only two versions I found on my network at the time of removal)

Now, in WSUS, I’m still seeing these as being installed, and when I look at the machines themselves, I found the following files on the computers (there's a tab between columns):

Path    Version Product 
C:\Windows\winsxs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_b7e610287b2b4ea5\msxml4.dll 4.20.9818.0    Microsoft(R) MSXML 4.0 SP 2 
C:\Windows\winsxs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9818.0_none_b7e811947b297f6d\msxml4.dll 4.20.9876.0    Microsoft(R) MSXML 4.0 SP 2 
C:\Windows\winsxs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.0.0_none_3658456fda6654f6\msxml4r.dll 4.10.9404.0  Microsoft(R) MSXML 4.0 SP1 
C:\Windows\winsxs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_365945b9da656e4d\msxml4r.dll 4.10.9404.0  Microsoft(R) MSXML 4.0 SP1 
C:\Windows\SysWOW64\msxml4.dll  4.20.9876.0 Microsoft(R) MSXML 4.0 SP 2 
C:\Windows\SysWOW64\msxml4r.dll 4.10.9404.0 Microsoft(R) MSXML 4.0 SP1

The registry is also littered with references to syswow64\msxml4.dll and syswow64\msxml4r.dll in the following locations (“\…” indicates several subkeys contain references): 

HKLM\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0 
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\... 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\... 
HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\... 
HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0 
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs

I’ve tried installing and removing the updates, but the files and references are still there.

I’m not entirely certain how to use the advice at https://altonblom.com/s34e10/, since my version numbers aren’t the same as the poster’s, and looking at http://support.microsoft.com/kb/269238 doesn’t help much either.

I’m not sure how to proceed, I still haven’t cracked the WinSXS nut.

austinian
  • 1,729
  • 2
  • 15
  • 30
  • Why the concern about removing it completely? Why isn't an uninstall good enough? – HopelessN00b Oct 29 '14 at 20:13
  • MSXML 4.0 is EOL, we don't want any applications using it if they detect that it's on the system. Since the DLL remains in the SysWOW64 and in WinSXS, this is still possible on said systems, using file path lookup or application manifests, respectively. – austinian Oct 29 '14 at 20:25
  • Just reached 2.5k views on this, wow. In WSUS, the updates listed above don't show up as installed if you move/delete the dll files in the SysWOW64 folder. This can help out anyone doing compliance reports with WSUS reporting. – austinian Jul 27 '15 at 17:20

0 Answers0