[Rumpel]

I recently installed AVG Free 7.5.476 on a friend's machine that is running Windows 98SE. The install, the update, and the building of a Rescue Disk set were uneventful.

Then I let it run a full scan. It first found and identified C:\WINDOWS\SYSTEM\MSVCR71.DLL as a threat, but without identifying any particular virus or other reason for the presumed threat. Later, it found an infected zipfile in the e-mail attachment folder. No other sign of infection was found.

At the conclusion of the scan, AVG Free said that it had deleted the infected attachment and healed the system file, and that a reboot was required to complete the process. On re-starting, I got a message that an unidentified program could not start because MSVCR71.DLL was missing. I soon found that trying to open AVG's Control Centre or Virus Vault also failed with a "MSVCR71.DLL missing" message, and the other AVG components would not respond at all. AVG's icon does not appear in the System Tray.

There are indications on the Web that MSVCR71.DLL is used by several progams, including MS Office 2003 and .NET. While MS Office 97 is installed on the machine, it seems unaffected by the absence of MSVCR71.DLL. MS .NET is not installed. I have not found any other programs on the machine that are affected by the absence of MSVCR71.DLL.

Before allowing AVG to take action on the files it found, I looked at MSVCR71.DLL in C:\WINDOWS\SYSTEM. The filedate and time was the same as the AVG files just installed, i.e, that day. After re-starting, MSVCR71.DLL was no longer present in C:\WINDOWS\SYSTEM. It had not been healed; it had disappeared entirely. I do not know if it was present in C:\WINDOWS\SYSTEM prior to installing AVG.

I tried using Windows' SFC to replace MSVCR71.DLL from the Windows 98 CD-ROM. SFC did not find that file. There were no other copies of MSVCR71.DLL anywhere on the hard drive.

The system has no other security software installed. NAV and Trend Micro's PC-Cillin were installed at some time in the past, but have been uninstalled. Some of their folders are still present on the machine.

It appears that AVG Free ate one of its own files. I could remove and re-install AVG Free -- but how would I prevent it from doing the same thing again?

[Elvandil]

That file is not an AVG file. It is one of Microsoft's C runtime files that are used to run programs written in that language.

You can replace that file by installing the Microsoft Visual C++ 2008 Redistributable Package, though this is the new version, so ME may not accept it. But I suspect that it will.

It is possible that the file actually was infected and has now been removed. About all you can do is install and try again.

[Rumpel]

Originally Posted by Elvandil

That file is not an AVG file. It is one of Microsoft's C runtime files that are used to run programs written in that language.

True. And here's a bit more info, seen at <http://www.annoyances.org/exec/forum/win98/t1233861956>:

That DLL file is part of Visual Basic C Runtime library 7.1 and is included with
any program written in that particular programming language.

You may have several copies of it in various locations, in whatever directory the
program/s are installed in.

Given the circumstances, there's every indication that that particular copy of MSVCR71.DLL was put in place by AVG Free when it was installed on that machine.

You can replace that file by installing the Microsoft Visual C++ 2008 Redistributable Package, though this is the new version, so ME may not accept it. But I suspect that it will.

ME? The system involved is running Win98SE.

[Elvandil]

Do you know what the location of the file was? It should be in the AV log.

In any case, it would be very unwise to try to simply replace that dll with one found on the internet. There are always many versions of any dll, and especially in 98, the wrong one can lead to serious system problems.

Does AVG 7.5 even claim to support 98? Not many things do.

[Rumpel]

As indicated, it was in C:\WINDOWS\SYSTEM. Fortunately, I checked on that before AVG did what it did. Now that AVG is not running, I can't access the AV log.

And yes -- Grisoft's website confirms that AVG Free 7.5 will run on Win98SE. That was why I chose that version to install on the machine in question. The current version is 8.5.

[Elvandil]

So if it is in the system folder, unless you could check the date, there is no way of knowing where that file came from. Since huge numbers of programs require the C libraries, it could have come from most anywhere.

So, I'd suggest re-installing those libraries. But you could also try reinstalling AVG, though it may not have the needed dll in order to run.

[Rumpel]

As noted in the fifth para. of my original post, MSVCR71.DLL had the same date and time as the files in C:\Program files\Grisoft\AVG, i.e., the date and time I installed AVG Free. Sure, a coincidence is possible, but as I installed nothing else that day, the probability of a coincidence is vanishingly small.

Why did I think to check the file's date and time before allowing AVG to proceed? Simple -- I suspected a false positive identification as far as MSVCR71.DLL was concerned, and wanted to know more about that file before AVG messed with it.

Sure, it's possible that AVG Free over-wrote a previously-existing copy of MSVCR71.DLL when it wrote its copy of that file to C:\Windows\System -- but most programs apparently write their copy of MSVCR71.DLL to their own folders, not C:\Windows\System. And I have not found any other program that reacts to the lack of that file on starting. In fact, there isn't a great deal of software installed on the machine. The owner of the machine is not a sophisticated user.

In short, there is nothing to indicate that MSVCR71.DLL was installed by any program other than AVG Free.

Yes, I could put another copy of MSVCR71.DLL in the C:\Windows\System folder. I have access to another machine that has a very similar configuration, i.e., is running AVG Free 7.5 on Win 98SE. Its copy of MSVCR71.DLL also has a date/time stamp that is identical to most of the files in C:\Program files\Grisoft\AVG. That installation dates from early 2005, but was updated the day before I ran the install on the machine in question. I did that to ensure that Grisoft is still providing updates for AVG Free 7.5 because support for that version was recently discontinued.

But what assurance do I have that AVG Free won't eat MSVCR71.DLL again? How do I prevent that? AVG Free gave me no options on the action it was taking on the first pass.

[Elvandil]

If the file was infected, it won't happen again. If the file was accessed on that day and time, its access date would be the same. But where and when it appeared is not really relevant. On many new versions of Windows, the C library is in the program's folder. But on very old systems, the library usually resided in the system folder.