none
"MSVCP100.dll is Missing" but really its just been renamed RRS feed

  • Question

  • Hi,

    I am working on a corporate estate which is currently experiencing a wide issue where upon start-up the message "The Program can't start because MSVCP100.dll is missing from your computer. Try reinstalling the program to fix this problem." This is specifically in relation to Adobe's Reader_SL.exe, which runs on start-up. It does also occur with other programs when they run such as FireTray.exe and a bespoke program I am trying to deploy to the estate via SCCM. I am happy that the programs reporting these errors are working as they are either part of the build or an SCCM deployment, and as stated its not affecting all machines/users.

    We run a mix of Win 8.1 (x64) and Win 7 (X86) and get this issues on a mixture of machines (not all but a lot). My suspicion is that another program, process or (dare is say it) malware is modifying this dll rather than outright deleting it. The image below highlights the results of a file search in C:\Windows\. The Last accessed date on these files suggests the date on which it was renamed.

    <Image waiting on MS to verify my account - 5 files named MSVCP100.dl821, MSVCP100.dl989, MSVCP100.dl53, MSVCP100.dl702, MSVCP100.dl894>

    I have Reinstalled C++ 2010 Redistributable (downloaded from Microsoft) on 3 machines with this error, and although working at first, within a few days the error has repeated on all 3. I have been using ProcMon with boot logging enabled to help me see if there is a process accessing this file and causing a name change but nothing appears evident. The last thing to access this file was CompatTelRunner.exe and mostly came back with successful results. Mostly as there are 2 entries which are not successful and result in "invalid parameter" and "Name Invalid", but then there are 7 further successful events after this.

    Due to the sensitive nature of the client I work for I am not able to easily post log file data (will need lots of redacting) but I will naturally provide as much info as I can.

    I need to Identify what is causing this apparent renaming of the DLL file so that any future attempt to reinstall the files from a proper source is not undermined, and so that existing application work properly.

    NB: It is worth noting that the client currently use a workaround of running Adobe reader, which triggers a file check and some level of reinstallation is then completed, which again works but only for a few days. Some users experience this everyday. But I am still yet to identify what's causing it.

    Many Thanks,

    Steve

    Monday, July 25, 2016 8:40 AM

Answers

  • Found the Issue and thus the solution. Turns out it was McAfee all along. For those who may encounter what I did here is what I found and how I found it out.

    McAfee's total solution includes a tool called Virtual Technician (or MVT). this is a self-checker which can run either a check only or remediation on the whole McAfee suite, ensure it is up to the right patching levels and act according to its config to report or fix any detected issues. Out client had this set to check and report only and ran once a week.

    Host Intrusion Prevention (HIPS) is also part of McAfee's suite and requires the aforementioned 2010 C++ libraries to function.

    When either of these was disabled on our test machine the symptom stopped. I was later able to replicate it by reinstalling HIPS and manually executing the "MVT Check" task. It would seem MVT detects an issue in HIPS, and HIPs tries to remediate itself by repairing or reinstalling. this in turn tries to reinstall C++2010, cant because its in use, and so it just uninstalls it instead, leaving the renamed .dll files in its wake.

    We use McAfee agent 4.8.0.1938, HIPS 8.0 and MVT7.6.0.280. Our solution was to update both HIPS and Virus Scan Enterprise to the most up-to-date Patch level. Our estate was running patch level 4 on both systems and after applying Patch level 7 to both we no longer have the issue. In addition to this installing Patch 7 on HIPS reinstalls the C++ library, so cures any systems actively affected by it as well.

    Hope this eventually helps someone else avoid months of brain-ache.

    • Marked as answer by Steve Hunt3r Thursday, September 22, 2016 12:28 PM
    Thursday, September 22, 2016 12:28 PM

All replies

  • Hi Steve Hunt3r,

    Can you find this file in C:\windows\system32 folder?

    According to the error message, a DLL must be a COM library for it to be registered. This might not be there is the DLL is not designed to be registered.

    An error may appear related to this file. The full description of the error is "The program can't start because MSVCP100.dll is missing from your computer. Try reinstalling the program to fix this problem." This error may appear at the time a program is crashed at its initiation stage.

    1. Reinstall Microsoft Visual C++ 2010 Redistributable Package (x64)

    MSVCP100.dll is a part of Microsoft Visual C++ 2010 Redistributable 64 bit Package. For resolving the error, you need to reinstall the whole package. You can download it for free from Microsoft website.

    Note: Though some websites let you download the file for free, I do not personally recommend it. Because there might be some sources providing spyware or malware files rather than the original file.

    2. System File Checker (SFC)

    3. System restore

    Hope it will be helpful to you


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com


    Thursday, July 28, 2016 9:59 AM
    Moderator
  • Hi Carl,

    Both MSVCP100.dll and MSVCR100.dll are present and seem unaltered in the system32 folder. this phenomenon seems limited to the versions of these files located in sysWOW64 only.

    One of my first solutions was to reinstall the C++ redistributable (x64) on 3 test machines. the first two seemed to work but then after 2 working days (4 in total due to the weekend) the error came back. I never heard back from the owner of the 3rd machine.

    I have not yet checked SFC, is this a Microsoft tool?

    System restore is not an option due to the number of remote end-user devices being affected.

    Thursday, July 28, 2016 12:58 PM
  • In addition and slight contract to the above, I our 4-bit Windows 8 devices this only affects the Syswow64 folder files. For our slightly older Win 7 devices which are only on 32-bit this therefore affects the System32 folder.

    Apologies for not making that clear earlier.

    Thursday, July 28, 2016 1:16 PM
  • Is it possible that one of 6 installed Windows updates are responsible for trying to update, modify or otherwise interact with the installed C++ libraries?

    There were 6 updates installed the day before one of my test machines started exhibiting this behaviour again.

    KB3170106 (an IE11 cumulative update)
    KB3170455
    KB3168965
    KB3163245
    KB3161608 (Some content has been pulled since release)
    KB2952664

    Monday, August 1, 2016 2:11 PM
  • Hi Steve Hunt3r,

    If the issue is occurred after you updating. I suppose that maybe it could be caused by Patch. I suggest that we could try temporarily uninstall these KB to check.

    Hope it will be helpful to you


    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, August 3, 2016 8:20 AM
    Moderator
  • Hi Carl,

    That is what we are working on at the moment. It's so far looking like something that repeats on a roughly weekly basis (on average at least) but all the machines I have so far looked at have dll files with the renamed extension where there is one on the day or day after it was built, then the next is always around mid-June (around the time patching for that month started).

    Waiting for MS to verify my account so I can actually post some screenshots.

    Wednesday, August 3, 2016 1:02 PM
  • I have a good news (sort of) update. This issue reoccurred on a Windows 7 (x86) laptop we have locally. Digging in the event log I can see that something called the program guid and triggered an uninstall without any input from us. There are no logs from SCCM that correspond to the same time, nor any McAfee logs (though it was performing an update at the time).

    Can anyone suggest why or how I can determine what triggered the msi uninstaller at this time? I found the detail in the Application logs in Event viewer, but it doesn't contain information on the source other that "msiinstaller".

    Kind Regards,

    Steve

    Tuesday, August 16, 2016 2:08 PM
  • Found the Issue and thus the solution. Turns out it was McAfee all along. For those who may encounter what I did here is what I found and how I found it out.

    McAfee's total solution includes a tool called Virtual Technician (or MVT). this is a self-checker which can run either a check only or remediation on the whole McAfee suite, ensure it is up to the right patching levels and act according to its config to report or fix any detected issues. Out client had this set to check and report only and ran once a week.

    Host Intrusion Prevention (HIPS) is also part of McAfee's suite and requires the aforementioned 2010 C++ libraries to function.

    When either of these was disabled on our test machine the symptom stopped. I was later able to replicate it by reinstalling HIPS and manually executing the "MVT Check" task. It would seem MVT detects an issue in HIPS, and HIPs tries to remediate itself by repairing or reinstalling. this in turn tries to reinstall C++2010, cant because its in use, and so it just uninstalls it instead, leaving the renamed .dll files in its wake.

    We use McAfee agent 4.8.0.1938, HIPS 8.0 and MVT7.6.0.280. Our solution was to update both HIPS and Virus Scan Enterprise to the most up-to-date Patch level. Our estate was running patch level 4 on both systems and after applying Patch level 7 to both we no longer have the issue. In addition to this installing Patch 7 on HIPS reinstalls the C++ library, so cures any systems actively affected by it as well.

    Hope this eventually helps someone else avoid months of brain-ache.

    • Marked as answer by Steve Hunt3r Thursday, September 22, 2016 12:28 PM
    Thursday, September 22, 2016 12:28 PM
  • Hi Steve Hunt3r,

    Glad to hear that you have found a solution and thank you for sharing it here, it will be helpful to other community members who have same questions.

    Best regards,

    Carl Fan


    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, September 26, 2016 1:36 AM
    Moderator