Security Update for MS XML Core Services 4.0 Service Pack 2(KB9361

I will leave my settings in Windows Update to...."Download Updates but let me
choose whether to Install them"...and will follow your procedures.

Perhaps this falls into to "leaving well enough alone", but you comment I
should not have been offered KB927978......and as I wrote, KB927978 is shown
in my Programs & Features list as Installed in my PC 4/17/08. Do we just
leave it installed or will it cause other future problems and therefore it
should be deleted?

If I understood you.....KB936181 is a newer Security update than
KB927978......and therefore should not have appeared as an available
Update...........

"MowGreen [MVP]" wrote:

> KB927978 should *not* have been offered as that is the update that
> contains msxml4.dll Version 4.20.9841.
> KB936181 [MS06-061] updated it to V. 4.20.9848 and that update
> superceded KB927978.
> One way it may have reverted to a lesser V. was when the Canon printer
> software was installed.
>
> It sounds as if the tech has correctly installed the update [941833]
> that " improves the compatibility and the reliability of Microsoft XML
> Core Services 4.0 Service Pack 2 on a Windows Vista-based computer ".
>
> In order to avoid any further installation issues with security updates
> to MSXML 4.0 SP2, suggest that the next time one appears, UNcheck the
> box next to it and then manually download and *save* a copy from either
> the MS Download Center:
> http://www.microsoft.com/downloads/S...displaylang=en
>
> or, grab it from the Microsoft Update Catalog:
> http://catalog.update.microsoft.com/v7/site/Home.aspx
>
> [ just enter the KB # in the Search field and confirm that it is
> intended for Vista, 32bit (x86) ]
>
> When the download completes disconnect the system from the net/network.
> Completely and *totally* disable PC-cillin
> *Right* click the downloaded update and choose 'Run as administrator'
> Follow the prompts, or just click Allow if no password is involved
> The update should install without a hassle since the MSXML 4 package is
> currently in a 'healthy' state
>
> Reboot
> Reenable PC-cillin
> Reconnect to the net/network
>
> MowGreen [MVP 2003-2008]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> denmarfl wrote:
>
> > The tech did not disable or stop anything processes or services from running.
> > He appeared to rename (in a cmd Window)...181 then ...933 showed as
> > available, ..then he renamed ...933, re-install them using a tool that he
> > clicked on Repair. I really feel my issue was caused when the newest
> > Security Update installed on my PC on 4/17 (it was the day after I saw the
> > security alert)...KB927928.
> >
> > As I recall when I experienced this same problem last year on my XP PC...you
> > had me delete all the Security Updates installed in ADD\REMOVE....starting
> > with the newest...to the oldest....rebooting after each install...Then you
> > provided me with a Link to download the most recent Security and installing
> > it manually. Again, as I recall, you wrote....the newest Security Update
> > always contains all the prior Updates.....so just having the newest installed
> > provided all the protection of the past Security Updates that had been
> > deleted.
> >
> > Wasn't this the procedure you had me follow? If so, would this process have
> > fixed this problem?
> >
> > I ask because this similar problem, as you wrote, seems to happen when new
> > Security Updates are installed and I suspect I'll see this again....hopefully
> > not...with future Security Updates.
> >
> > Thanks
> > "MowGreen [MVP]" wrote:
> >
> >
> >>Excellent news. You're mowst welcome and thanks for keeping anyone
> >>reading this thread 'updated'<w>
> >>Apparently both KB936181 and KB941833 were never properly installed as
> >>the Version of msxml4.dll that was present, 4.20.9841.0, was from a
> >>previous security update. Somehow, using the Repair option resolved this.
> >>Did the tech stop any Services or Process before using the Repair option
> >>and/or did he disable any protections of PC-cillin ?
> >>
> >>One of these days *someone* is going to figure out why MSXML security
> >>updates are so problematic to some and not to others.
> >>
> >>MowGreen [MVP 2003-2008]
> >>===============
> >> *-343-* FDNY
> >>Never Forgotten
> >>===============
> >>
> >>
> >>
> >>denmarfl wrote:
> >>
> >>
> >>>I believe I have good news..... I got a call from a Microsoft Tech agent
> >>>just now regarding this problem. You'll recall I commented I worked with a
> >>>Microsoft Tech Agent a few days ago without any resolution. The Agent used
> >>>Easyassist...and Renamed the nsxl14 file to OLD (KB936181)...and used the
> >>>KB936181 Repair tool to downloan the this Update and re-install it. After it
> >>>was re-installed.....PcCillin NO longer displayed the Security Alert (which
> >>>really increases my Confidence this Virus Software is working great)....
> >>>But, after the Re-boot, Windows Update showed KB941833 as an Available
> >>>Update. However, this Update was shown as installed (as was KB936181) in
> >>>Programs and Features. The agent checked the version of KB941833....it was
> >>>not the current version.....and I think he renamed KB941833....and
> >>>re-installed it (he was operating my PC...so his actions were at times
> >>>difficult to follow) What did surprise me is when he was manually
> >>>re-installing these 2 updates the Window that displayed showed
> >>>...Modify\Repair\Uninstall...and in both cases he clicked Repair (I would
> >>>have thought a selection would be Install).
> >>>
> >>>Bottom line...so far...PcCillin is not showing any Security Alerts.....and
> >>>Windows Updates is Not showing me KB936181 or KB941833 as available. I hope
> >>>that continues. The agent did say Microsoft is working on a Fix for this
> >>>issue.......
> >>>
> >>>You have worked with me in the past and when you latched onto this issue I
> >>>knew you would resolve the problem.....I cannot express how appreciative I am
> >>>of your help....you are a teacher and a Fixer. Thank You
> >>>
> >>>"MowGreen [MVP]" wrote:
> >>>
> >>>
> >>>
> >>>>OK, on my XP Pro system the backup copy of msxml4.dll is stored in
> >>>>WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf3 45378f_4.20.9848.0_x-ww_1b897e9a
> >>>>*not* in the dllcache, as I had first thought.
> >>>>
> >>>>The file that is used is stored in
> >>>>WINDOWS\system32
> >>>>
> >>>>What entries for MSXML 4.0 show in Installed Programs on your Vista box?
> >>>>AFAIK, msxml4.dll should be located in the WINDOWS\system32 subfolder.
> >>>>Since MSXML 4 is not native to Vista it must have been installed with
> >>>>the Canon printer software.
> >>>>
> >>>>Is the Version of Trend Micro PCcillin Internet Security installed the
> >>>>latest and greatest ?
> >>>>
> >>>>MowGreen [MVP 2003-2008]
> >>>>===============
> >>>> *-343-* FDNY
> >>>>Never Forgotten
> >>>>===============
> >>>>
> >>>>
> >>>>
> >>>>denmarfl wrote:
> >>>>
> >>>>
> >>>>
> >>>>>Used Windows Explorer......Search in Windows\system 32 Returned 3 items
> >>>>>
> >>>>>* msxm12.dll Version 4.20.9841.0
> >>>>>* msxm14r.dll Version 4.10.9404.0
> >>>>>* msxm14a.dll Version 4.10.9404.0
> >>>>>
> >>>>>Search in Windows\System32\dllcache Returned No results (there
> >>>>>was no Folder or file listed as dllcache)
> >>>>>
> >>>>>I went no further with your last set of Instructions then the search since I
> >>>>>came up with 3 returns, only in one Folder,and you wrote if "BOTH" versions
> >>>>>matched.... and the returns I found did not match the version numbers of
> >>>>>those you listed. Getting no results in the Windows\system32\dllcache
> >>>>>search...is this OK?
> >>>>>
> >>>>>
> >>>>>
> >>>>>"MowGreen [MVP]" wrote:
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>>Thanks. Using Windows Explorer, look for msxml4.dll in
> >>>>>>
> >>>>>>WINDOWS\system32
> >>>>>>WINDOWS\system32\dllcache
> >>>>>>
> >>>>>>Right click the .dlls, choose Properties
> >>>>>>Click the Version tab
> >>>>>>If KB941833 is NOT installed, then the Version level should show as
> >>>>>>4.20.9848.0
> >>>>>>IF KB941833 is installed, then the Version level will show as
> >>>>>>4.20.9849.0
> >>>>>>
> >>>>>>IF both copies of msxml4.dll are at that *same* Version level
> >>>>>>
> >>>>>>Start Search
> >>>>>>type in command
> >>>>>>Click Search
> >>>>>>*Right* click command and choose Run as administrator
> >>>>>>At the prompt type in and *press Enter* after the following -
> >>>>>>
> >>>>>>regsvr32 msxml4.dll
> >>>>>>exit
> >>>>>>
> >>>>>>Please post back with the Version levels of both copies of msxml4.dll
> >>>>>>
> >>>>>>
> >>>>>>MowGreen [MVP 2003-2008]
> >>>>>>===============
> >>>>>>*-343-* FDNY
> >>>>>>Never Forgotten
> >>>>>>===============
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>denmarfl wrote:
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>OK...this thread will be the only one used...in keeping with that, I have
> >>>>>>>copied and pasted my last reply to you that I entered under the other
> >>>>>>>thread...
> >>>>>>>
> >>>>>>>"Under File Options I have "Show Hidden Files and Folders Checked 9I don't
> >>>>>>>see
> >>>>>>>show System Files). I ran a search for msxml4.dll...and got No results.
> >>>>>>>When I ran the search just using msxml4 I got...msxml4-KB936181-enu.exe which
> >>>>>>>is a tool I downloaded fron Microsoft that was supposed to make the KB936181
> >>>>>>>Security Update more compatible. However, when I ran the tool I got back
> >>>>>>>"Error opening installation log. verify that the Specified Log file location
> >>>>>>>exists and is writable". I did not get back the results you specified in
> >>>>>>>your reply.
> >>>>>>>
> >>>>>>>I did a Search "My Computer"...for the KB941833.log...no results
> >>>>>>>
> >>>>>>>Since I didn't fine the files you referred to, "Search for
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>>msxml4.dll.
> >>>>>>>>The one in %windir%\system32 should be at Version 4.20.9849.0 as should
> >>>>>>>>be the one in %windir%\system32\dllcache.
> >>>>>>>
> >>>>>>>
> >>>>>>>I didn't continue with your steps to await further advice from you. I am
> >>>>>>>running Vista Home Prem; SP1.
> >>>>>>>
> >>>>>>>You asked me to Post the name of the Security Software; Internet Security
> >>>>>>>PcCillin... I have been running it since 11/07...and this MS07-042 only
> >>>>>>>appeared last week the day after I Hide the KB936181 Update so iut wouldn't
> >>>>>>>keep installing and Updated to Vista Home Prem SP1
> >>>>>>>
> >>>>>>>Await your further advices....and...Thank You"
> >>>>>>>
> >>>>>>>"MowGreen [MVP]" wrote:
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>>Let's stick to this thread instead of having other ones currently
> >>>>>>>>active, OK ?
> >>>>>>>>As I posted to the other thread:
> >>>>>>>>
> >>>>>>>>Show hidden files, folders, and system files and then do a Search for
> >>>>>>>>msxml4.dll.
> >>>>>>>>The one in %windir%\system32 should be at Version 4.20.9849.0 as should
> >>>>>>>>be the one in %windir%\system32\dllcache.
> >>>>>>>>
> >>>>>>>>IF they are both at that Version level, from an Elevated Command Prompt,
> >>>>>>>>see if registering msmxl4.dll resolves the reoffering issue:
> >>>>>>>>
> >>>>>>>>Start Search
> >>>>>>>>type in command
> >>>>>>>>Click Search
> >>>>>>>>*Right* click command and choose Run as administrator
> >>>>>>>>At the prompt type in and *press Enter* after the following -
> >>>>>>>>
> >>>>>>>>regsvr32 msxml4.dll
> >>>>>>>>exit
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>MowGreen [MVP 2003-2008]
> >>>>>>>>===============
> >>>>>>>>*-343-* FDNY
> >>>>>>>>Never Forgotten
> >>>>>>>>===============
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>denmarfl wrote:
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>>Internet Security PcCillin.....PcCllin runs a Security check once a week.
> >>>>>>>>>The MS07-042 follows the day when I took the following 2 actions;
> >>>>>>>>>1) Unchecked the KB936181 and Clicked Hide to keep it from appearing in
> >>>>>>>>>Windows Automatic Updates and installing) This Updates shows as Sucessfully
> >>>>>>>>>installed 11 times in my Windows History.
> >>>>>>>>>2) Updating Vista Home prem to SP1 (and that update went without any
> >>>>>>>>>problems and shows sucessfully Installed in History)
> >>>>>>>>>
> >>>>>>>>>Canon Printer (not sure what further detail you might need)
> >>>>>>>>>
> >>>>>>>>>"MowGreen [MVP]" wrote:
> >>>>>>>>>
> >>>>>>>>>

MowGreen [MVP] wrote:

> One of these days *someone* is going to figure out why MSXML security
> updates are so problematic to some and not to others.

I thought I'd heard this was due to printer software locking the file?

Harry.

You heard correctly, Harry. Although 'certain' AVs|Sec suites also can
be the cause, it is mostly due to printer software loading on boot.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============


Harry Johnston [MVP] wrote:

> MowGreen [MVP] wrote:
>
>> One of these days *someone* is going to figure out why MSXML security
>> updates are so problematic to some and not to others.
>
>
> I thought I'd heard this was due to printer software locking the file?
>
> Harry.

denmarfl wrote:

> I will leave my settings in Windows Update to...."Download Updates but let me
> choose whether to Install them"...and will follow your procedures.
>
> Perhaps this falls into to "leaving well enough alone", but you comment I
> should not have been offered KB927978......and as I wrote, KB927978 is shown
> in my Programs & Features list as Installed in my PC 4/17/08. Do we just
> leave it installed or will it cause other future problems and therefore it
> should be deleted?
>
> If I understood you.....KB936181 is a newer Security update than
> KB927978......and therefore should not have appeared as an available
> Update...........
>

Since KB941833 is installed, having the previous updates installed is
irrelevant since msxml4.dll is now at a higher Version level than the
ones included in the updates.
If it ain't broke ... <w>

I'm guessing that when the Canon software was installed msxml4.dll
reverted to a lesser V. level. As to why KB927978 would not be offered
for around 4 months ... dunno why. One would think that KB931681 would
have been offered instead.
Remember, I don't work here, it just seems like it.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============

So much for a long lasting resolution to the dreaded KB936181 Problem... It
showed up today as an Important Update to Install (I had thought working with
the Microsoft tech agent 5 days ago it was fixed...never to be seen again).
When I hide KB936181, then KB927978 appeared in the Update Window. Both of
these Security Updates are shown as installed in Program & Features.

Any easy fix?

"MowGreen [MVP]" wrote:

> You heard correctly, Harry. Although 'certain' AVs|Sec suites also can
> be the cause, it is mostly due to printer software loading on boot.
>
> MowGreen [MVP 2003-2008]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> Harry Johnston [MVP] wrote:
>
> > MowGreen [MVP] wrote:
> >
> >> One of these days *someone* is going to figure out why MSXML security
> >> updates are so problematic to some and not to others.
> >
> >
> > I thought I'd heard this was due to printer software locking the file?
> >
> > Harry.
>

Check the file Version of msxml4.dll.
Since KB941833 is supposed to be installed now, the V. should be
4.20.9849.0
http://support.microsoft.com/kb/941833

If it's not, then some 'thing' is either reverting it back to a lesser
V. or it's not registering correctly.

From an Elevated Command prompt [locate cmd, *right* click it and
choose 'Run as admin'] run this

regsvr32 msxml4.dll
exit

Did that help ?


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============


denmarfl wrote:

> So much for a long lasting resolution to the dreaded KB936181 Problem... It
> showed up today as an Important Update to Install (I had thought working with
> the Microsoft tech agent 5 days ago it was fixed...never to be seen again).
> When I hide KB936181, then KB927978 appeared in the Update Window. Both of
> these Security Updates are shown as installed in Program & Features.
>
> Any easy fix?
>
> "MowGreen [MVP]" wrote:
>
>
>>You heard correctly, Harry. Although 'certain' AVs|Sec suites also can
>>be the cause, it is mostly due to printer software loading on boot.
>>
>>MowGreen [MVP 2003-2008]
>>===============
>> *-343-* FDNY
>>Never Forgotten
>>===============
>>
>>
>>Harry Johnston [MVP] wrote:
>>
>>
>>>MowGreen [MVP] wrote:
>>>
>>>
>>>>One of these days *someone* is going to figure out why MSXML security
>>>>updates are so problematic to some and not to others.
>>>
>>>
>>>I thought I'd heard this was due to printer software locking the file?
>>>
>>> Harry.
>>

Before I proceed with your suggested action..... Microsoft made a followup
call to me.....and I advised what had taken place, KB936181 was be offered
again for Install. If I hide it, then KN927978 would show as an available
Update. If I hide ...978, then KB 1941833 would appear as an available
update. All 3 of these security updates appear in my Program & Features Lists.

The Agent did many things, and finally ..181 & 978 don't show as available
updates, but KB941833 does.

The Agent seem satisfied all was well, but he sensed I did not feel that
way. The agent them Remotely ran a Diagnostic test, "Microsoft Support
Diagnostics Report". That report shows an Error message......

SYSTEM Details: The Windows Update log has recorded errors in the last seven
days that may prevent access to Windows Update.......

Followed by a Header "SUMMARY of WINDOW UPDATE ERRORS"......

Then there are 10 items listed none of which mean anything to me......nor
are any of them dated.

The agent then tried to stop some services...I recall Windows Update was one
of them....tried to delete a few files Caroot2 could have been 1 of the
files......

KB941833 still continues to show as an available Update and the Error
message.... I realize the rsults in the Diagnostic Report are timed
stamp...so I would expect anything that was done following the creation of
the report would change its findings (and of course it still shows Windows
error in the past 7 days may prevent access to Windows Update)

The call was ended...it lasted 3almost 3 hours....with the agent advising he
would elevate the problem and I would get a call back.......

I sure hope "other" things have not been messed up......


"MowGreen [MVP]" wrote:

> Check the file Version of msxml4.dll.
> Since KB941833 is supposed to be installed now, the V. should be
> 4.20.9849.0
> http://support.microsoft.com/kb/941833
>
> If it's not, then some 'thing' is either reverting it back to a lesser
> V. or it's not registering correctly.
>
> From an Elevated Command prompt [locate cmd, *right* click it and
> choose 'Run as admin'] run this
>
> regsvr32 msxml4.dll
> exit
>
> Did that help ?
>
>
> MowGreen [MVP 2003-2008]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> denmarfl wrote:
>
> > So much for a long lasting resolution to the dreaded KB936181 Problem... It
> > showed up today as an Important Update to Install (I had thought working with
> > the Microsoft tech agent 5 days ago it was fixed...never to be seen again).
> > When I hide KB936181, then KB927978 appeared in the Update Window. Both of
> > these Security Updates are shown as installed in Program & Features.
> >
> > Any easy fix?
> >
> > "MowGreen [MVP]" wrote:
> >
> >
> >>You heard correctly, Harry. Although 'certain' AVs|Sec suites also can
> >>be the cause, it is mostly due to printer software loading on boot.
> >>
> >>MowGreen [MVP 2003-2008]
> >>===============
> >> *-343-* FDNY
> >>Never Forgotten
> >>===============
> >>
> >>
> >>Harry Johnston [MVP] wrote:
> >>
> >>
> >>>MowGreen [MVP] wrote:
> >>>
> >>>
> >>>>One of these days *someone* is going to figure out why MSXML security
> >>>>updates are so problematic to some and not to others.
> >>>
> >>>
> >>>I thought I'd heard this was due to printer software locking the file?
> >>>
> >>> Harry.
> >>
>

Stay with the Support Agent. Let MS get to the bottom of whatever is
causing this strange issue.
Please keep the newsgroup posted on what the outcome is.

I strongly suspect corruption in the WinSxS directory is causing this
but, what caused the corruption in the first place ?

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============


denmarfl wrote:

> Before I proceed with your suggested action..... Microsoft made a followup
> call to me.....and I advised what had taken place, KB936181 was be offered
> again for Install. If I hide it, then KN927978 would show as an available
> Update. If I hide ...978, then KB 1941833 would appear as an available
> update. All 3 of these security updates appear in my Program & Features Lists.
>
> The Agent did many things, and finally ..181 & 978 don't show as available
> updates, but KB941833 does.
>
> The Agent seem satisfied all was well, but he sensed I did not feel that
> way. The agent them Remotely ran a Diagnostic test, "Microsoft Support
> Diagnostics Report". That report shows an Error message......
>
> SYSTEM Details: The Windows Update log has recorded errors in the last seven
> days that may prevent access to Windows Update.......
>
> Followed by a Header "SUMMARY of WINDOW UPDATE ERRORS"......
>
> Then there are 10 items listed none of which mean anything to me......nor
> are any of them dated.
>
> The agent then tried to stop some services...I recall Windows Update was one
> of them....tried to delete a few files Caroot2 could have been 1 of the
> files......
>
> KB941833 still continues to show as an available Update and the Error
> message.... I realize the rsults in the Diagnostic Report are timed
> stamp...so I would expect anything that was done following the creation of
> the report would change its findings (and of course it still shows Windows
> error in the past 7 days may prevent access to Windows Update)
>
> The call was ended...it lasted 3almost 3 hours....with the agent advising he
> would elevate the problem and I would get a call back.......
>
> I sure hope "other" things have not been messed up......
>
>
> "MowGreen [MVP]" wrote:
>
>
>>Check the file Version of msxml4.dll.
>>Since KB941833 is supposed to be installed now, the V. should be
>>4.20.9849.0
>>http://support.microsoft.com/kb/941833
>>
>>If it's not, then some 'thing' is either reverting it back to a lesser
>>V. or it's not registering correctly.
>>
>> From an Elevated Command prompt [locate cmd, *right* click it and
>>choose 'Run as admin'] run this
>>
>>regsvr32 msxml4.dll
>>exit
>>
>>Did that help ?
>>
>>
>>MowGreen [MVP 2003-2008]
>>===============
>> *-343-* FDNY
>>Never Forgotten
>>===============
>>
>>
>>denmarfl wrote:
>>
>>
>>>So much for a long lasting resolution to the dreaded KB936181 Problem... It
>>>showed up today as an Important Update to Install (I had thought working with
>>>the Microsoft tech agent 5 days ago it was fixed...never to be seen again).
>>>When I hide KB936181, then KB927978 appeared in the Update Window. Both of
>>>these Security Updates are shown as installed in Program & Features.
>>>
>>>Any easy fix?
>>>
>>>"MowGreen [MVP]" wrote:
>>>
>>>
>>>
>>>>You heard correctly, Harry. Although 'certain' AVs|Sec suites also can
>>>>be the cause, it is mostly due to printer software loading on boot.
>>>>
>>>>MowGreen [MVP 2003-2008]
>>>>===============
>>>> *-343-* FDNY
>>>>Never Forgotten
>>>>===============
>>>>
>>>>
>>>>Harry Johnston [MVP] wrote:
>>>>
>>>>
>>>>
>>>>>MowGreen [MVP] wrote:
>>>>>
>>>>>
>>>>>
>>>>>>One of these days *someone* is going to figure out why MSXML security
>>>>>>updates are so problematic to some and not to others.
>>>>>
>>>>>
>>>>>I thought I'd heard this was due to printer software locking the file?
>>>>>
>>>>> Harry.
>>>>