msvcp71.dll and msvcr71.dll files deleted from system32 on SEP 11 uninstall or upgrade

Products

• Endpoint Protection

Issue/Introduction

On an upgrade from Symantec Endpoint Protection (SEP) 11.0 to 12.1, or an uninstall of the 11.0 product, the msvcp71.dll and msvcr71.dll files get deleted from the Windows system32 folder. One or more 3rd party applications depending on these DLL files later fail to launch.

 

Cause

Windows tracks the use of shared DLL files in under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

The count for each DLL is incremented when additional applications requiring them are installed. When applications are uninstalling the value is decremented, and if 0 is reached (ie. no other applications require the file) the file is deleted.

If the SharedDLLs value for a particular file is wrong (ie. if one 3rd party application requiring the DLL has failed to increment the value when installing), then the DLL could potentially be deleted when an unrelated application uninstalls.

(SEP 12.1 uses a newer version of this library, and will not install this particular version back to the machine on upgrade)

 

Resolution

If the SharedDLLs value for msvcp71.dll and msvcr71.dll is not set correctly, there are two options:

• Increment the registry value (manually or via a script) before upgrading from SEP 11.
• Copy the msvcp71.dll and msvcr71.dll files back to the machine after the upgrade.