msvcr100.dll: the Visual C++ 2010 runtime, or malware hiding behind its name?

What msvcr100.dll is, and why attackers like the name

msvcr100.dll holds the C runtime of Visual C++ 10.0, the compiler of Visual Studio 2010: memory management, file input and output, string and maths functions. A program built with that compiler does not carry this code itself; it loads msvcr100.dll when it starts. Its only own dependency is KERNEL32.dll, a core part of Windows.

Because so many programs from that period load msvcr100.dll, and because they look for it in their own folder before the Windows folders, a file with this name placed next to such a program is loaded without any warning. Attackers pick a signed, trusted program that imports msvcr100.dll, drop their own file with that name beside it, and let the trusted program start their code. Security tools then see a known, signed process doing the work.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of msvcr100.dll

Three things decide: the folder, the signature and the program that loads the file. A DLL never shows in Task Manager under its own name, so use these checks instead.

1. List every copy, with size and date. Run this in PowerShell. Copies in Windows, Program Files and game folders are normal. Look closely at copies in C:\Users\Public, AppData, Temp, Downloads or a new ProgramData folder, especially recent ones.

   Get-ChildItem -Path C:\ -Filter msvcr100.dll -Recurse -Force -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Check the signature of each copy you are unsure about. Status must be Valid and the signer Microsoft Corporation. NotSigned, HashMismatch or another name means the file is not an unchanged Microsoft build. The malicious copies in the reported cases were the attackers' own files, not signed by Microsoft.

   Get-ChildItem -Path C:\ -Filter msvcr100.dll -Recurse -Force -ErrorAction SilentlyContinue | Get-AuthenticodeSignature | Select-Object Path, Status, @{n='Signer';e={$_.SignerCertificate.Subject}}

3. See which program has it loaded. In Process Explorer (Microsoft Sysinternals) open Find, Find Handle or DLL, and type msvcr100.dll. Each result shows the process and the full path of the copy it loaded. A Microsoft Office or other signed program running from a user or ProgramData folder and loading msvcr100.dll from that same folder is the side-loading pattern.
4. Look at the files beside it. In the reported cases the malicious msvcr100.dll sat with a legitimate .exe and often a data file: Wordconv.exe with msvcr100.dat (2023), a Word 2013 executable with a folder named “_” (2025). A Microsoft program you never installed, in a folder it does not belong to, together with msvcr100.dll, is a strong sign.
5. Compare size and checksum. The last Microsoft builds are 829,264 bytes (x64) and 773,968 bytes (x86); older genuine builds differ. The file check on this page compares the SHA-256 with the builds we know. A match identifies the version; the signature check above decides whether the file is genuine.

A valid Microsoft signature clears that one file. It says nothing about the program next to it or the other files in the folder, which are the parts an attacker controls.

Do you need msvcr100.dll?

Keep the copies in Windows and in the programs you installed: older games and tools stop starting without them. Remove only a copy that failed the checks above, together with what came with it.

1. Leave System32, SysWOW64 and program folders alone. These copies belong to the Visual C++ 2010 package or to the program itself. A copy there that is signed by Microsoft is not a threat, even if a cleaner tool calls it old.
2. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds before you delete anything by hand.
3. Run the offline scan. A malicious DLL that runs inside a trusted program can stay hidden while Windows runs. The offline scan restarts the PC and scans before Windows loads.

   Start-MpWDOScan

4. Delete the whole suspicious folder. If a copy failed the signature check and sits with an .exe in C:\Users\Public, Temp, AppData, Downloads or ProgramData, delete that folder, not just the DLL. The launcher left behind can load a new copy.
5. Remove what starts it again. Check Settings, Apps, Startup, Task Scheduler and the Run keys below for entries that start a program from a user or ProgramData folder. The 2025 PXA Stealer chain added a Run key so that its payload started at every boot.

   Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'

6. Change passwords if a stealer may have run. PXA Stealer took saved browser passwords, cookies, autofill data and cryptocurrency wallet files. From a clean device, change the passwords stored in your browsers, starting with e-mail and banking, sign out other sessions and move funds out of any wallet that was on the PC.

Warning signs

How attackers have used msvcr100.dll

Three published cases, each with the report it comes from. In all three a legitimate program loaded a malicious file named msvcr100.dll from its own folder.

MITRE ATT&CK lists this as Hijack Execution Flow: DLL (T1574.001). For a home PC the folder matters more than the name: a genuine msvcr100.dll lives in the Windows folders or in programs you installed, while a fake one keeps the same name and shows up in a user or ProgramData folder beside a borrowed program.

Programs that have been made to load a fake msvcr100.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted msvcr100.dll. Usually the attacker copies the program into another folder and puts a fake msvcr100.dll next to it: Windows looks in the program's own folder first. A msvcr100.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine msvcr100.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

Source: the HijackLibs entry for msvcr100.dll, 3 public reports.

Known versions of msvcr100.dll

A public DLL catalogue lists 28 versions of msvcr100.dll, from 10.0.20327.1 to 10.0.40219.473, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix msvcr100.dll errors on uGetFix

Questions people ask