We have run into an issue where an old version of MSXML (4), now unsupported, is lighting up on security scans. ArcGIS Desktop up to 10.3 requires this software (and the installer will put it back if you try to remove it). But Desktop 10.3.1 and later doesn't need it. This script will remove MSXML 4 from a machine (unless some other software puts it back).
I've also posted apython script you can use to check your machine for MSXML4 vulnerability. Note other software can cause this vulnerability, but ArcGIS 10.3 and earlier definitely will.
:: RemoveMSXML4.bat
::
:: Removes MSXML4 from a system
::
:: BUG-000082328: ArcGIS for Desktop 10.2.2 installs Microsoft XML Core
:: Services (MSXML) 4.0 Service Pack 2 automatically. MSXML 4.0 has some vulnerability issues.
:: (Only open to Esri customers with support right-to-call as of 3/7/2015)
