Is your msvcr110.dll the real Microsoft file or a planted fake?

What msvcr110.dll does

msvcr110.dll contains the C runtime of Visual Studio 2012: the code for memory, files, text and maths that a program would otherwise have to carry itself. The 110 stands for toolset version 11.0. Programs written in C++ also load msvcp110.dll, the C++ library from the same package.

The file arrives with the Visual C++ 2012 Redistributable, whose last release is Update 4. Microsoft lists Visual C++ 2012 as no longer supported but still links those installers. Because the runtime is old, some programs ship their own copy next to their .exe, and Windows looks in a program's folder before it looks in System32. Attackers use exactly that search order.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of msvcr110.dll

Four questions settle it: where the copy is, who signed it, how big it is and which program loads it. A DLL never appears in Task Manager under its own name, so use these checks.

1. Find every copy with its size. Run this in PowerShell. The official files are 849,360 bytes (x64) and 875,472 bytes (x86), and the Windows image build is 849,488 bytes. A copy much smaller than that, or one under AppData, Temp, Downloads or ProgramData, needs the next check.

   Get-ChildItem -Path C:\ -Filter msvcr110.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Check the signature. Status must be Valid and the signer Microsoft Corporation. The fakes described in the reports were the attackers' own DLLs, so NotSigned, HashMismatch or any other signer means the copy is not Microsoft's file.

   Get-AuthenticodeSignature "C:\path\to\msvcr110.dll" | Format-List Status, SignerCertificate

3. Look for a file called MSVCR110.dat next to it. The genuine runtime never comes with a .dat file of the same name. In the 2019 case the fake DLL read its encrypted payload from MSVCR110.dat in the same folder. Finding the pair is a strong sign of the attack.

   Get-ChildItem -Path C:\Users -Filter msvcr110.dat -Recurse -Force -ErrorAction SilentlyContinue | Select-Object FullName

4. See which program loads it. In Process Explorer (Microsoft Sysinternals) choose Find, Find Handle or DLL, and type msvcr110.dll. The results show each process and the path of the copy it uses. A signed program from a security or network vendor, running from AppData or with an unexpected name, loading a msvcr110.dll from its own folder is the reported pattern.
5. Compare the checksum. Use the file check on this page. A match with a Microsoft build means the file is genuine. No match on a copy outside the Windows folders, together with a missing signature, means you should treat it as malicious.

A valid Microsoft signature clears that msvcr110.dll. It does not vouch for the program that loads it or for other files in the same folder, so a copy in a user folder is still worth one look at its neighbours.

Do you need msvcr110.dll?

Yes, the genuine copies: programs built with Visual Studio 2012 will not open without them. Act only on a copy that failed the checks above, and then deal with the whole folder and whatever starts it.

1. Keep the copies in System32, SysWOW64 and program folders. They come from the Visual C++ 2012 Redistributable or from the program itself. Removing them breaks those programs and removes no threat.
2. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Let Defender quarantine what it finds before you delete anything by hand.
3. Run the offline scan as well. In the 2019 case the malware injected itself into msiexec.exe and kept running inside it. The offline scan restarts Windows and scans before such code can start. It takes about 15 minutes.

   Start-MpWDOScan

4. Remove the service or task that starts it. The 2019 malware installed a service named WanServer that ran its copy from a hidden %APPDATA%\Windows folder. Open Services and Task Scheduler and look for entries that start a program from AppData, ProgramData or Temp.

   Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'AppData|ProgramData|Temp' } | Select-Object Name, PathName

5. Delete the folder, not only the DLL. A fake msvcr110.dll comes with the signed program that loads it and often a payload file. Delete the whole folder once the scans are done, so nothing is left to load another copy.
6. If a program needs the runtime afterwards, reinstall it from Microsoft. Install the Visual C++ 2012 Update 4 Redistributable, x64 and x86, from Microsoft's download links. Do not take a replacement msvcr110.dll from a file download site.

Warning signs

How attackers have used msvcr110.dll

Two published cases, each with its report. In both, the msvcr110.dll was not Microsoft's file: it was a malicious DLL given this name so that a legitimate program would load it from its own folder.

MITRE ATT&CK lists this as Hijack Execution Flow: DLL (T1574.001). For msvcr110.dll the lesson is the opposite of the genuine-dependency cases: here the file carrying the name was the fake, so its signature and size give it away.

Known versions of msvcr110.dll

A public DLL catalogue lists 7 versions of msvcr110.dll, from 11.0.50214.1 to 11.0.51106.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix msvcr110.dll errors on uGetFix

Questions people ask