MSXML 3.0, 4.0 and 6.0

Question

I have been assigned to find-out what certain machines (7(32/64)/2008 R2(32/64) and 2003 R2(32) are reporting thru NESSUS Tool as outstanding for the MSXML 4.0 SP2. The article reference by Nessus is dated as 12/2013 and the releases for MSXML 3/4/6 for
SP3 are not available.While surfing I find out there is a Dowload stand alone new release for MSXML 3.0 SP11 dated 2/2014. reading a couple articles I found the MSXML 3.0 is limited version of MSXML 6.0 for backword compatibility and
legacy support. The MSXML 4.0 is being superseded by MSXML 6.0. I have not found the lates version for MSXML 6.0 as a stand alone download. My worstation it does contain a MSXML 3.0 SP11 matching the download stand alone version I found,
but I also have MSXML 6.0 SP3. Is there a resdtributabled or framework version .net that loads these dll to the target marchine. I have found out for instance Windows Vista machines does include this dll out of the box. I also have read
that SQL Server 2005 provides MSXML 6.0 dll when down loaded. Is there any one that they coud guide me to find these dlls?  
michael john ocasio

Answer 1

With the machines that are in compliance; other words they do not have MSXML version 4.0 installed but it does have the latest for MSXML 3.0 AND 6.0.
MSXML 6.0 SP3 Version 6.30.7601.17988 (MS13-002 -- KB2757638)
MSXML 3.0 SP11 Version 8.110.7601.18334 (MS14-005 – KB2916036)
Should we assume these machines never had the MSXML 4.0
That seems a reasonable assumption. Perhaps more relevant that they don't have it now; probably not much relevant whether they did or did not have it in the past.
or it was removed by latest Windows malicious SOFTWARE removal tool (KB890830).
Uh, no, that's not within the scope of operations performed by the MSRT.
Is this a unnecessary effort to find out why machines never had this MSXML assuming they were build with the same image template?
I would think the previous descriptions of where MSXML4 comes from should address thsi question. MSXML4 was distributed ONLY BY ISVs with their products that required an a MSXML engine. If you didn't install an ISV product using MSXML4 on your reference machine,
then there's absolutely no reason to think there would be instances of MSXML4 cloned throughout your environment. Any machines that do have MSXML4 almost certainly acquired it due to a post-image application installation.
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.