2

A program has installed c:/windows/syswow64/msxml4.dll on my hard drive. Sadly this is an old version (4.30.2100.0) with a security problem therefore I really wants to remove the file and the program that installed it.

MSXML4 is not in the list of programs that I can uninstall under "Programs and features". Is there a way to find the program that installed it in windows 8.1?

Hope some of you can help.

  • First of all, why are you even trying to remove a system file? Is there a specific reason for this? – Vinayak Aug 23 '14 at 14:13
  • 1
    The particular version contain a security problem that I would like to fix. Windows update does not suggest anything. – Rolf Aug 23 '14 at 15:15
  • 3
    That's the latest version but MSXML 4.0 SP3 has been unsupported since April 2014, so there will be no more security updates. support.microsoft.com/gp/msxmlannounce – David Marshall Aug 23 '14 at 15:40
  • 1
    @DavidMarshall: OK. But in that case it would still be good to know what program installed the file so that I can uninstall the program and tell the vendor that they distribute components with security flaws. – Rolf Aug 23 '14 at 15:45
  • 2
    No. You can run a program like Dependency Walker dependencywalker.com against your third party applications if you don't have too many. – David Marshall Aug 23 '14 at 15:58
3

Finding dependencies

As suggested by @DavidMarshall, you could use Dependency Walker:

Dependency Walker is a free utility that scans any 32-bit or 64-bit Windows module (exe, dll, ocx, sys, etc.) and builds a hierarchical tree diagram of all dependent modules. For each module found, it lists all the functions that are exported by that module, and which of those functions are actually being called by other modules.

Source: Dependency Walker (depends.exe) Home Page

If you have many programs, however, going through all of them is unfeasible. A different approach is to open an elevated command prompt, and run the following command:

type nul>"%temp%\find.txt" & for /r "%systemdrive%\" %G in (*.exe;*.dll) do @find /i "msxml4.dll" "%~fG" >nul 2>&1 && echo %~fG>>"%temp%\find.txt"

What the command does is to recursively scan the content of every application and library file available in the system drive looking for msxml4.dll strings, in a case-insensitive way.

The results are stored in a find.txt file located in the user temporary folder. It's not perfect (see below), but it might give you some hints.

Remarks

  • The find command is designed for text files. While it also works for binary files, certain instances could be overlooked depending how they're stored. File permissions might prevent certain files from being scanned, too.

  • In case you have programs which aren't installed in the system drive you can re-run the command above and specify the corresponding drive letter.

  • You could include other extensions, such as:

    .cpl = Control panel item
    .ocx = ActiveX control
    .scr = Screen saver
    .sys = System file (e.g. device drivers)
    

Further reading

2

This is what I came up with for scanning with powershell. I'm new to powershell so it might not be pretty but it works.

$hostName     = hostname

$appFilePath  = "C:\Windows\Temp\DLL_$hostName.csv"

$scanPath     = 'C:\'

$exefile      = "*.exe"

$dllFile      = "*.dll"

The following creates list of all DLLs and EXEs on c$:

$dll = dir -ErrorAction SilentlyContinue -Recurse -Path $scanPath -Include @($exefile, $dllFile)

The following looks at each file to see if it references MSXML4.dll. Takes about 30 mins on my 149gb of data:

$dll | Select-String "msxml4.dll" -ErrorAction SilentlyContinue | group $($_.name) | select name | export-csv -path $appFilePath`

The output isn't formatted so you'll get something like:

C:\Windows\SysWOW64\migwiz\unbcl.dll:45:Cclass UnBCL::TimeSpan __thiscall UnBCL::TimeSpan::Add(const class UnBCL::TimeSpan &) constresult of TimeSpan additio..... and so on 

unbcl.dll is on every machine I've scanned and it can be ignored. I think it's just looking for MSXML4.dll even if it's not on the machine.

You'll also get great stuff like this:

"C:\Users\USERX\Documents\Toad for Oracle 10.1 - R2 Commercial.exe:5045:File_Name=""msxml4.dll"" "
0

A better scan would be adding windows\system32 and/or windows\syswow64

For example:

type

nul>"%temp%\find.txt" & for /r "%systemdrive%\windows\syswow64" %G in (*.exe;*.dll) do @find /i "msxml4.dll" "%~fG" >nul 2>&1 && echo %~fG>>"%temp%\find.txt"
  • What does this do? What can they do after this is run to fix the problem? – Canadian Luke Aug 27 '14 at 21:34
  • It just help identify the applications that still uses msxml4.dll. You then have the choise to uninstall the application or ask the vendor to upgrade their product to use a later version. – Rolf Aug 28 '14 at 9:15
  • Scanning %ProgramFiles% and %ProgramFiles(x86)% might be more useful in this case. – David Marshall Sep 2 '14 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.