I then read this Microsoft bulletin, and under Suggested Actions it said "Microsoft has removed the DigiNotar root certificate from the Microsoft Certificate Trust List."
So why do they still show up in the list for IE8 in XP?
Is Microsoft talking about a different list?
Should I delete both of the DigiNotar Root certificates?
Here is what I have learned so far and what I did.
Windows Vista and higher have been patched according to Microsoft I checked the Application Event log for "CAPI2" events, I found no entries for DigiNotar install or removal, so maybe they were not there in the first place.
XP will have an update soon to take care of this issue, learned this from a link posted in the comments by Linker3000
What I did for XP, Went to Control Panel > Internet Options > Content Tab > Certificates button > Trusted Root Certificate tab. I exported both DigiNotar trusted certificates to a folder, then I deleted them from the Trusted Certs list.
Once deleted, I went to the "Untrusted Publishers" tab and imported the certs I exported earlier, then I closed the Certificates windows. Then clicked the "Clear SSL State" on the Content tab, this clears and certificate caches you have, then closed Internet Options.
You should clear the caches in Vista and Windows 7 also, this will be done on reboot however you may not reboot for a while.
EDIT 2: Microsoft has released an update for Windows KB-2607712