api-ms-win-core-path-l1-1-0.dll: a Microsoft API set name, or a file someone else made?

What api-ms-win-core-path-l1-1-0.dll is, and why copies of it turn up where they should not

Since Windows 8, Microsoft groups Windows functions into API sets: contract names that start with api- or ext- and end in a version such as l1-1-0. A program imports the contract name, and the Windows loader looks it up in the API set schema and routes the call to the library that holds the code. Microsoft states plainly that an API set name identifies a contract, not a file, and that there is not necessarily a file with that name anywhere on the PC. The .dll ending is there only because import tables spell module names that way.

api-ms-win-core-path-l1-1-0 is the contract for the PathCch functions, which combine and canonicalize paths and handle long paths with the \\?\ prefix. Microsoft lists Windows 8 and Windows Server 2012 as their minimum and KernelBase.dll as their home. Where Windows keeps a stub file under the contract name, it describes itself as ApiSet Stub DLL and carries the Windows build number, which is why the copies collected in a public DLL catalogue report 6.2.9200 and 6.3.9600, the builds of Windows 8 and Windows 8.1.

The trouble comes from Windows 7. Python 3.9 and later, programs packaged with them and other software built for Windows 8 and later import this name, and on Windows 7 they stop with a message that the file is missing. People search for it, and the results offer single files for download, "fixer" programs and replacement DLLs that imitate the path functions. None of these is Microsoft's file for Windows 7, because no such file exists. Some are honest workarounds written by others, some are of unknown origin, and every one placed next to a program's .exe is loaded by that program with your account's rights.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a genuine api-ms-win-core-path-l1-1-0.dll from one you should not trust

A DLL is not listed in Task Manager as a process, so use the Windows version, the folder, the signature and the version resource.

1. Which Windows the PC runs. Run winver. On Windows 7 any file with this name is not a Microsoft file for that system, so the only question is where it came from. On Windows 8 and later, go on with the next checks.

   Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber

2. Where every copy is. List all copies. One in the Windows system folders on Windows 8 or later can be Windows' own stub. A copy in a program folder, Downloads, Desktop, Temp or AppData was put there by an installer, a fixer or a person, never by Windows.

   Get-ChildItem C:\ -Recurse -Filter api-ms-win-core-path-l1-1-0.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

3. Read the version resource. Microsoft's stub reports Microsoft Corporation as the company and ApiSet Stub DLL as the description, with a version that matches a Windows build. Empty fields, another company or a description such as a project name point to a replacement. Text fields can be copied, so this alone does not clear a file.

   (Get-Item "C:\path\to\api-ms-win-core-path-l1-1-0.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

4. Check the digital signature. Status Valid with a Microsoft signer means an unmodified Microsoft file. NotSigned, HashMismatch or another signer means it is not Microsoft's as shipped, whatever its text fields say. Windows files can also be signed through a catalog, so check a copy in the Windows folders with sfc if the signature shows NotSigned.

   Get-AuthenticodeSignature "C:\path\to\api-ms-win-core-path-l1-1-0.dll" | Format-List Status, SignerCertificate

5. Compare the checksum. The public catalogue knows two Microsoft builds, both 32-bit. A match identifies one of them. No match is not proof of a fake for a copy inside Windows 8 or later, because other genuine builds exist; for a copy outside the Windows folders, the folder already tells you it was not put there by Windows.

A valid Microsoft signature clears that one file. It does not clear the fixer program, archive or installer that brought a copy to a program folder or a Windows 7 PC, which is where unwanted software from such downloads usually sits.

Do you need api-ms-win-core-path-l1-1-0.dll?

On Windows 8 and later, leave what Windows keeps in its own folders alone: the system resolves the name and needs nothing else. A copy anywhere else is not needed by Windows, and on Windows 7 a copy does not make programs built for newer Windows truly supported.

1. Leave the Windows folders alone on Windows 8 and later. A stub in the Windows system folders is part of the system. If you suspect it is damaged, let Windows check it with sfc /scannow from an administrator Command Prompt rather than deleting or replacing it by hand.
2. Delete copies you or a fixer added. Remove api-ms-win-core-path-l1-1-0.dll from program folders, Downloads, Desktop and Temp, and from System32 or SysWOW64 on Windows 7. Windows does not use them there, and an unknown copy next to a program runs inside it.
3. Uninstall any DLL fixer program. Open Settings, Apps, Installed apps (Control Panel, Programs and Features on Windows 7), find the fixer or the download tool that offered the file and uninstall it. Such programs often bring other software along.
4. Run a full scan with Windows Security. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds and look at Protection history for items in Downloads, Temp or AppData. On Windows 7 use the security program you have installed.
5. Run the offline scan on Windows 10 or 11. Some unwanted software hides while Windows runs. The offline scan restarts the PC and scans before Windows starts, in about 15 minutes.

   Start-MpWDOScan

6. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. Disable and remove entries that run a program from AppData, ProgramData or Temp that you do not recognise.

Warning signs

Known versions of api-ms-win-core-path-l1-1-0.dll

A public DLL catalogue lists 2 versions of api-ms-win-core-path-l1-1-0.dll, from 6.2.9200.16384 to 6.3.9600.16384, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix api-ms-win-core-path-l1-1-0.dll errors on uGetFix

Questions people ask