Re: Security Update for MS XML Core Services 4.0 Service Pack 2(KB

The tech did not disable or stop anything processes or services from running.
He appeared to rename (in a cmd Window)...181 then ...933 showed as
available, ..then he renamed ...933, re-install them using a tool that he
clicked on Repair. I really feel my issue was caused when the newest
Security Update installed on my PC on 4/17 (it was the day after I saw the
security alert)...KB927928.

As I recall when I experienced this same problem last year on my XP PC...you
had me delete all the Security Updates installed in ADD\REMOVE....starting
with the newest...to the oldest....rebooting after each install...Then you
provided me with a Link to download the most recent Security and installing
it manually. Again, as I recall, you wrote....the newest Security Update
always contains all the prior Updates.....so just having the newest installed
provided all the protection of the past Security Updates that had been
deleted.

Wasn't this the procedure you had me follow? If so, would this process have
fixed this problem?

I ask because this similar problem, as you wrote, seems to happen when new
Security Updates are installed and I suspect I'll see this again....hopefully
not...with future Security Updates.

Thanks
"MowGreen [MVP]" wrote:

Excellent news. You're mowst welcome and thanks for keeping anyone
reading this thread 'updated'<w>
Apparently both KB936181 and KB941833 were never properly installed as
the Version of msxml4.dll that was present, 4.20.9841.0, was from a
previous security update. Somehow, using the Repair option resolved this.
Did the tech stop any Services or Process before using the Repair option
and/or did he disable any protections of PC-cillin ?

One of these days *someone* is going to figure out why MSXML security
updates are so problematic to some and not to others.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



denmarfl wrote:

I believe I have good news..... I got a call from a Microsoft Tech agent
just now regarding this problem. You'll recall I commented I worked with a
Microsoft Tech Agent a few days ago without any resolution. The Agent used
Easyassist...and Renamed the nsxl14 file to OLD (KB936181)...and used the
KB936181 Repair tool to downloan the this Update and re-install it. After it
was re-installed.....PcCillin NO longer displayed the Security Alert (which
really increases my Confidence this Virus Software is working great)....
But, after the Re-boot, Windows Update showed KB941833 as an Available
Update. However, this Update was shown as installed (as was KB936181) in
Programs and Features. The agent checked the version of KB941833....it was
not the current version.....and I think he renamed KB941833....and
re-installed it (he was operating my PC...so his actions were at times
difficult to follow) What did surprise me is when he was manually
re-installing these 2 updates the Window that displayed showed
...Modify\Repair\Uninstall...and in both cases he clicked Repair (I would
have thought a selection would be Install).

Bottom line...so far...PcCillin is not showing any Security Alerts.....and
Windows Updates is Not showing me KB936181 or KB941833 as available. I hope
that continues. The agent did say Microsoft is working on a Fix for this
issue.......

You have worked with me in the past and when you latched onto this issue I
knew you would resolve the problem.....I cannot express how appreciative I am
of your help....you are a teacher and a Fixer. Thank You

"MowGreen [MVP]" wrote:


OK, on my XP Pro system the backup copy of msxml4.dll is stored in
WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a
*not* in the dllcache, as I had first thought.

The file that is used is stored in
WINDOWS\system32

What entries for MSXML 4.0 show in Installed Programs on your Vista box?
AFAIK, msxml4.dll should be located in the WINDOWS\system32 subfolder.
Since MSXML 4 is not native to Vista it must have been installed with
the Canon printer software.

Is the Version of Trend Micro PCcillin Internet Security installed the
latest and greatest ?

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



denmarfl wrote:


Used Windows Explorer......Search in Windows\system 32 Returned 3 items

* msxm12.dll Version 4.20.9841.0
* msxm14r.dll Version 4.10.9404.0
* msxm14a.dll Version 4.10.9404.0

Search in Windows\System32\dllcache Returned No results (there
was no Folder or file listed as dllcache)

I went no further with your last set of Instructions then the search since I
came up with 3 returns, only in one Folder,and you wrote if "BOTH" versions
matched.... and the returns I found did not match the version numbers of
those you listed. Getting no results in the Windows\system32\dllcache
search...is this OK?



"MowGreen [MVP]" wrote:



Thanks. Using Windows Explorer, look for msxml4.dll in

WINDOWS\system32
WINDOWS\system32\dllcache

Right click the .dlls, choose Properties
Click the Version tab
If KB941833 is NOT installed, then the Version level should show as
4.20.9848.0
IF KB941833 is installed, then the Version level will show as
4.20.9849.0

IF both copies of msxml4.dll are at that *same* Version level

Start Search
type in command
Click Search
*Right* click command and choose Run as administrator
At the prompt type in and *press Enter* after the following -

regsvr32 msxml4.dll
exit

Please post back with the Version levels of both copies of msxml4.dll


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



denmarfl wrote:


OK...this thread will be the only one used...in keeping with that, I have
copied and pasted my last reply to you that I entered under the other
thread...

"Under File Options I have "Show Hidden Files and Folders Checked 9I don't
see
show System Files). I ran a search for msxml4.dll...and got No results.
When I ran the search just using msxml4 I got...msxml4-KB936181-enu.exe which
is a tool I downloaded fron Microsoft that was supposed to make the KB936181
Security Update more compatible. However, when I ran the tool I got back
"Error opening installation log. verify that the Specified Log file location
exists and is writable". I did not get back the results you specified in
your reply.

I did a Search "My Computer"...for the KB941833.log...no results

Since I didn't fine the files you referred to, "Search for



msxml4.dll.
The one in %windir%\system32 should be at Version 4.20.9849.0 as should
be the one in %windir%\system32\dllcache.


I didn't continue with your steps to await further advice from you. I am
running Vista Home Prem; SP1.

You asked me to Post the name of the Security Software; Internet Security
PcCillin... I have been running it since 11/07...and this MS07-042 only
appeared last week the day after I Hide the KB936181 Update so iut wouldn't
keep installing and Updated to Vista Home Prem SP1

Await your further advices....and...Thank You"

"MowGreen [MVP]" wrote:




Let's stick to this thread instead of having other ones currently
active, OK ?
As I posted to the other thread:

Show hidden files, folders, and system files and then do a Search for
msxml4.dll.
The one in %windir%\system32 should be at Version 4.20.9849.0 as should
be the one in %windir%\system32\dllcache.

IF they are both at that Version level, from an Elevated Command Prompt,
see if registering msmxl4.dll resolves the reoffering issue:

Start Search
type in command
Click Search
*Right* click command and choose Run as administrator
At the prompt type in and *press Enter* after the following -

regsvr32 msxml4.dll
exit


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



denmarfl wrote:




Internet Security PcCillin.....PcCllin runs a Security check once a week.
The MS07-042 follows the day when I took the following 2 actions;
1) Unchecked the KB936181 and Clicked Hide to keep it from appearing in
Windows Automatic Updates and installing) This Updates shows as Sucessfully
installed 11 times in my Windows History.
2) Updating Vista Home prem to SP1 (and that update went without any
problems and shows sucessfully Installed in History)

Canon Printer (not sure what further detail you might need)

"MowGreen [MVP]" wrote:





Security Software identified a High Alert Security

Specifically, what is the installed security software ?
What is the printer software that is installed ?


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============


denmarfl wrote:





You assisted me with a problem with the Security Update KB936181. Back in
November I was having a problem getting the Update Installed....and after
your assistance, it installed.

But this same Update is Haunting me...again. My Security Software
identified a High Alert Security problem....it referred to it as MS07-042.
Reading this Microsoft article it mentions the KB936181 Update. Looking at
my Windows Update History I see KB936181 installed on my Vista Home prem
PC...11 times. Once in Nov '07...and 10 times this Month (April). Each
entry shows Status as Sucessful. In fact this Update was continuing to show
in the Available Updates...and a Microsoft Tech Agent directed me to Uncheck
it, right click on it and click Hide.

I do believe this Update, KB936181....is somehow connected to...or causing
the High Alert my Security Software is alerting me to (MS07-042)

Any suggestions?

Looking at Program and features, I see 3 MSXML 4.0 SP2 Installed (KB927978
installed 4/17/08, KB936181 installed 11/26/07, KB941833 installed 11/28/07
In this exact order.....

"MowGreen [MVP]" wrote:






If you have Automatic Updates set to Notify then when you click the
yellow shield in the system tray a window will pop up with the updates
listed.
Click on each individual update and then use the More Information link
in the lower pane to see what the update is about. The link will take
you to the MSKB article. Then use the IT Professional link to view the
Security Bulletin information IF the update was Security related.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============


denmarfl wrote:






I hear you on Disabling the Virus Software.... Since you never know what
updates are ready to install when you click on the Sheild you have no way to
know if its a MSXML download.... So to be safe, I will disable the Virus
Software (Norton) before I click on the Notification sheild....so no matter
what the update....the Virus Software will be...always...disabled.
.

Relevant Pages

  • How can I download these updates in French?
    ... Download size: 455 KB, 5 minutes ... Windows XP Professional. ... A security issue has been identified that could allow an attacker to ... You can help protect your computer by installing ...
    (microsoft.public.windowsupdate)
  • Re: KB938127 - Problems and questoins
    ... A security issue has been identified in the way Vector Markup Language is ... handled that could allow an attacker to compromise a computer running Microsoft Windows ... You can help protect your computer by installing this update ...
    (microsoft.public.windowsupdate)
  • Re: Cant access data under my profile in my old hard drive
    ... that also means NTFS was used. ... installing the drive in a Windows 9x computer ... Generally you do not bypass one security feature with a lesser ...
    (microsoft.public.windowsxp.security_admin)
  • Re: hardware firewall
    ... >> comment was about firewalls and security based on his question. ... he wanted to limit the connections to his Windows development web server ... month and am installing over $328K worth of them next week. ... >> I would assume, from your comment, that you've never run a Windows based ...
    (comp.security.misc)
  • IT Security Administrator in Bend, OR
    ... workstations as well as physical security for I/T systems. ... manages network security software and hardware. ... Extensive experience with Windows 2000/2003 servers and Exchange ... Two years experience configuring, installing and implementing VMWare ...
    (comp.arch)