msvcrt.dll: genuine Windows C runtime, or a copy that only borrows the name?

What msvcrt.dll is, and why other copies turn up

msvcrt.dll holds the standard C runtime: the functions a program written in C uses to print and format text, open and read files, allocate and free memory, compare strings and read the time. Its name comes from the Microsoft Visual C++ runtime of the 1990s. Microsoft later declared it an operating system DLL, to be used only by Windows components, and newer Visual C++ versions ship their own numbered runtimes instead. Windows still includes it and updates it with every release, because many older programs and some tools built with other compilers load it.

Because Windows lists msvcrt.dll among its known DLLs, every program gets the copy from System32, or from SysWOW64 for 32-bit programs, no matter what lies in the program's own folder. That makes the classic trick of placing a fake library next to a program much less useful with this name than with libraries such as version.dll or dinput8.dll. It also means a msvcrt.dll in any other folder has no job to do for Windows.

Such copies still appear. Old installers sometimes copied the runtime next to their program, portable tools carry it, and backup or unpacked driver folders can hold one. Those files are Microsoft's builds and simply unused. The ones that matter are different: a file named msvcrt.dll in AppData, Temp or ProgramData that is not signed by Microsoft, or that a scheduled task, a Run key or rundll32 starts. A familiar system name is an easy disguise, and a file that hides behind it is whatever its author made it.

So the question is not whether msvcrt.dll is a virus, but which file you are looking at. The two copies in the Windows folders are Microsoft's. For any other copy, the folder, the signature, the hash and what starts it decide.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell Windows' msvcrt.dll from another copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell, Autoruns and the checker on this page.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies; WinSxS and servicing folders also hold Microsoft's builds. Every other path is a copy Windows does not use, so find out which program it belongs to.

   Get-ChildItem C:\ -Recurse -Filter msvcrt.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Version';e={$_.VersionInfo.FileVersion}}

2. The Description, version and size. Right-click the file, Properties, Details. The genuine file says Windows NT CRT DLL, with Microsoft Corporation as the company and a version that starts with 7.0 and continues with a Windows build number. Compare the size with the facts table. A fake can copy these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\msvcrt.dll' | Format-List Status, SignatureType, SignerCertificate

4. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A copy outside the Windows folders that matches is an unneeded Microsoft file; one that matches nothing and is unsigned is not Microsoft's.
5. What starts it. Run Autoruns from Microsoft Sysinternals as administrator and search for msvcrt. Nothing in Windows starts msvcrt.dll on its own through a Run key, a scheduled task or rundll32. An entry that does, especially from AppData, Temp or ProgramData, points to the file that needs attention.
6. Scan before you delete. Run Microsoft Defender's full scan, and the offline scan if a detection returns after removal. Never delete the copies in System32 or SysWOW64, whatever a tool says, before you have checked their hash and signature.

A match to a Microsoft build proves the file is Microsoft's. A copy outside the Windows folders that does not match is not automatically malicious: it can be an old runtime that a program installed. What decides is whether it is signed, what starts it and which program it belongs to.

Warning signs and what they mean

Everyday problems with msvcrt.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

msvcrt.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 130 Microsoft builds in total are known.

Known versions of msvcrt.dll

A public DLL catalogue lists 22 versions of msvcrt.dll, from 6.0.8397.0 to 7.0.19041.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix msvcrt.dll errors on uGetFix

Questions people ask