Remove c:/windows/syswow64/msxml4.dll

Question

A program has installed c:/windows/syswow64/msxml4.dll on my hard drive. Sadly this is an old version (4.30.2100.0) with a security problem therefore I really wants to remove the file and the program that installed it.

MSXML4 is not in the list of programs that I can uninstall under "Programs and features". Is there a way to find the program that installed it in windows 8.1?

Hope some of you can help.

Answer 1

Finding dependencies

As suggested by @DavidMarshall, you could use Dependency Walker:

Dependency Walker is a free utility that scans any 32-bit or 64-bit Windows module (exe, dll, ocx, sys, etc.) and builds a hierarchical tree diagram of all dependent modules. For each module found, it lists all the functions that are exported by that module, and which of those functions are actually being called by other modules.

_{Source: Dependency Walker (depends.exe) Home Page}

If you have many programs, however, going through all of them is unfeasible. A different approach is to open an elevated command prompt, and run the following command:

type nul>"%temp%\find.txt" & for /r "%systemdrive%\" %G in (*.exe;*.dll) do @find /i "msxml4.dll" "%~fG" >nul 2>&1 && echo %~fG>>"%temp%\find.txt"

What the command does is to recursively scan the content of every application and library file available in the system drive looking for msxml4.dll strings, in a case-insensitive way.

The results are stored in a find.txt file located in the user temporary folder. It's not perfect (see below), but it might give you some hints.

Remarks

• The find command is designed for text files. While it also works for binary files, certain instances could be overlooked depending how they're stored. File permissions might prevent certain files from being scanned, too.

• In case you have programs which aren't installed in the system drive you can re-run the command above and specify the corresponding drive letter.

• You could include other extensions, such as:

  .cpl = Control panel item
  .ocx = ActiveX control
  .scr = Screen saver
  .sys = System file (e.g. device drivers)
  

Further reading

• Command-Line Reference

Answer 2

This is what I came up with for scanning with powershell. I'm new to powershell so it might not be pretty but it works.

$hostName     = hostname

$appFilePath  = "C:\Windows\Temp\DLL_$hostName.csv"

$scanPath     = 'C:\'

$exefile      = "*.exe"

$dllFile      = "*.dll"

The following creates list of all DLLs and EXEs on c$:

$dll = dir -ErrorAction SilentlyContinue -Recurse -Path $scanPath -Include @($exefile, $dllFile)

The following looks at each file to see if it references MSXML4.dll. Takes about 30 mins on my 149gb of data:

$dll | Select-String "msxml4.dll" -ErrorAction SilentlyContinue | group $($_.name) | select name | export-csv -path $appFilePath`

The output isn't formatted so you'll get something like:

C:\Windows\SysWOW64\migwiz\unbcl.dll:45:Cclass UnBCL::TimeSpan __thiscall UnBCL::TimeSpan::Add(const class UnBCL::TimeSpan &) constresult of TimeSpan additio..... and so on 

unbcl.dll is on every machine I've scanned and it can be ignored. I think it's just looking for MSXML4.dll even if it's not on the machine.

You'll also get great stuff like this:

"C:\Users\USERX\Documents\Toad for Oracle 10.1 - R2 Commercial.exe:5045:File_Name=""msxml4.dll"" "

Answer 3

A better scan would be adding windows\system32 and/or windows\syswow64

For example:

type

nul>"%temp%\find.txt" & for /r "%systemdrive%\windows\syswow64" %G in (*.exe;*.dll) do @find /i "msxml4.dll" "%~fG" >nul 2>&1 && echo %~fG>>"%temp%\find.txt"