msvbvm50.dll: Microsoft's old Visual Basic runtime, or a file that only carries the name?

What msvbvm50.dll does

msvbvm50.dll is the run-time library of Visual Basic 5.0, which its version resource calls the Visual Basic Virtual Machine. A program compiled with Visual Basic 5.0 is small because it hands much of its work to this library: starting up, drawing its windows and controls, handling text, numbers and files, and reporting errors. Without the file such a program does not start at all.

Microsoft lists msvbvm60.dll, the Visual Basic 6.0 runtime, among the files that ship in Windows, but msvbvm50.dll is not on that list. So the older runtime reaches a PC only through a program's installer or through Microsoft's package Msvbvm50.exe, both of which put it into the Windows system folder or next to the program. That is why the name alone says nothing: a genuine copy is identified by its folder, what it reports about itself and its size.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of msvbvm50.dll

Four questions decide it: where the file is, what it says about itself, how big it is, and whether a program you know uses it. A library never shows in Task Manager under its own name, so use these checks instead.

1. List every copy and where it sits. One copy in C:\Windows\SysWOW64 (or System32 on 32-bit Windows) is normal, and so is a copy next to the .exe of an old program you installed. Look closer at copies in Downloads, Desktop, Temp, AppData or ProgramData, and at a copy beside an .exe with a random name.

   Get-ChildItem -Path C:\ -Filter msvbvm50.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Read the version resource. Microsoft's file reports Microsoft Corporation as the company, Visual Basic Virtual Machine as the description and a file version that starts with 5.1 or 5.2. Empty fields or another company mean the file is not Microsoft's runtime, though a careful fake can copy these fields.

   (Get-Item "C:\path\to\msvbvm50.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

3. Compare the size. The Microsoft copies in the catalogue are 1,342,177 or 1,352,663 bytes. A file of a few kilobytes or several megabytes under this name is a different file, whatever its version fields say. Use the file check on this page to compare the checksum with the known copies.

   (Get-Item "C:\path\to\msvbvm50.dll").Length

4. Check the digital signature. A build this old may carry no signature of its own, so NotSigned alone does not prove a fake. HashMismatch, or a signer that is not Microsoft, does mean the file is not Microsoft's as shipped.

   Get-AuthenticodeSignature "C:\path\to\msvbvm50.dll" | Format-List Status, SignerCertificate

5. Find the program it belongs to. A copy in the system folder serves every Visual Basic 5.0 program on the PC, so think of the old programs you use. A copy outside the system folder should sit beside the .exe of a program you can name. A lone runtime in a folder with no program, or beside one you never installed, is the reason to keep looking.

A copy that passes these checks clears that one file. It says nothing about the program that brought it: if that program is one you do not recognise, the program is what needs checking.

Do you need msvbvm50.dll?

Keep the copy in the system folder and any copy inside an old program you use: without it those programs do not start. A copy that failed the checks above came with something else, and the safe way out is to remove that program, not only the DLL.

1. Leave the system folder copy alone. A genuine msvbvm50.dll in C:\Windows\SysWOW64 may be used by any Visual Basic 5.0 program on the PC. Windows itself does not need it, but deleting it gains nothing and stops those programs from starting.
2. Remove old programs you no longer use. Open Settings, Apps, Installed apps, find the old program and uninstall it. Its own copy of msvbvm50.dll goes with it. The shared copy in the system folder usually stays behind, which is harmless.
3. Uninstall a program you do not recognise. If the copy that failed the checks sits beside a program you never installed, uninstall that program from Installed apps. If it has no uninstaller, note the folder path, then delete the whole folder after the scan below, not only the DLL.
4. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds, then look at Protection history for anything found in Downloads, Temp or AppData.
5. Run the offline scan. Some malware hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

6. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. After the scan, disable and remove entries that run a program from AppData, ProgramData or Temp that you do not recognise.

Warning signs

Known versions of msvbvm50.dll

A public DLL catalogue lists 3 versions of msvbvm50.dll, from 5.1.43.19 to 5.2.82.44, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix msvbvm50.dll errors on uGetFix

Questions people ask