Joe,

i just checked it out myself, noting the following:

C:\WINDOWS\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll , version 9.0.37029.1 , is reported as insecure.

however, i also have

C:\WINDOWS\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll, version 9.0.30729.4148 on my system, which is secure.  

Apparently, (only) the second version is the patched one, and secunia is CORRECTLY identifying the first as unpatched.

I'm assuming that the PC will correctly find the newer version when/if needed;  nonetheless, I renamed the older file (so as to keep it around... just in case) --- and pasted a copy of the newer one into the older one's folder.

Ky:

I am being notified of 3 "moderately critical" insecure programs by PSI:
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841
C:\WINDOWS\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2

MS Updates says I am up to date with patches. And any attempt to patch these from within PSI fails.

This advisory was released by Secunia on July 28, and updated August 12. Why is PSI only informing me now? Looks like a definite Secunia error to me.

Joe,

as to why secunia is suddenly picking up on these now, I can't give you any good answer.   (you may have also noticed, it's gotten around to detecting Opera 10 in its secure browsing tab).

do you also have a secure version showing up under secunia's patched list?   or does a windows search show up an additional copy, most likely

C:\WINDOWS\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll, version 9.0.30729.4148    ???

my assumption is that Microsoft's update is looking for the presence of the 4148 update, and if found, it says you don't need anything more.   I am further assuming that, as part of the update process, Microsoft registers the most recent update in the registry, over-writing any reference(s) to prior versions.   from that perspective, if only the most recent one is listed in the registry, then it's almost as if the older versions "aren't there" [from Microsoft's point of view].   But Secunia is looking for them anyway.

it's entirely likely that these older files [including their directories] can be completely deleted, without any negative consequences.   I only did the rename + copy/paste to play it extra safe, since these steps are fully reversible (if it turns out i'm wrong about my assumptions).

EDIT:   I've looked (again) at the Secunia forum thread you cited, and see that user LazerFx has asserted:

"Actually, the WinSXS folder is designed so that applications that expect different versions of DLL's to be available can use them - it's the application cache, similar to the Global Assembly Cache for .NET applications...
Removing these from the system can, and most likely will cause problems - because applications will expect a specific version, and when that is not available, they will fail to work."

If so, it would be best to simply ignore them, as F/P's... or perhaps try the (reversible) rename + copy/paste... but not to remove them.

I went with my gut instincts and left all well enough alone.

Today PSI does not detect them. Go figure ...

Joe,

You beat me by a few minutes to the retest.   Taking advantage of my reversible procedure, I was able to re-instate the older .dll file... rerun the secunia scan... and, as you likewise noted, secunia no longer objected to this alternative/older version.

But I'm glad you posted here, as this thread served a greater purpose:   through it, I discovered the WinSxS ("Side-by-Side") directory.   This "feature" allows Windows to keep around multiple versions of a file, so that applications which are  version-dependent  can choose to load whichever version of the file that they need.   in particular, this means that these files/directories should NOT be deleted... nor should any WinSxS files be replaced by newer versions.

for more information, see:

http://www.winvistaclub.com/f16.html