binkw32.dll: RAD's Bink Video library, a mod's proxy, or malware?

What binkw32.dll does

binkw32.dll is the Windows library of Bink Video, the video codec RAD Game Tools makes for games. A developer licenses the Bink SDK and puts the DLL next to the game's executable. When the game plays a publisher logo, the intro or a cutscene, it opens the .bik file through this library, which decodes the picture and sound frame by frame. RAD states that Bink DLLs are not replaceable: each game is built for its own version, and RAD's free RAD Video Tools for viewing Bink files do not contain the DLL.

The same design makes the file a target. Windows looks for a DLL in the program's own folder first, and a game loads binkw32.dll early and without question. Mod tools use this as a proxy: they rename the original and put their own binkw32.dll in its place, which loads the original and then their code. That is legitimate when you installed the mod on purpose. The same trick, known as DLL search order hijacking, lets a crack, a trainer or malware run code inside the game, and a planted copy can do anything the game is allowed to do.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of binkw32.dll

Four questions decide it: where the file is, what it says about itself, what sits next to it, and where the game came from. A library never shows in Task Manager under its own name, so use these checks.

1. List every copy and where it sits. Copies inside game install folders are normal, one per game that uses Bink. Look closer at copies in Downloads, Desktop, Temp, AppData, ProgramData or the Windows folders, where no game loads them.

   Get-ChildItem -Path C:\ -Filter binkw32.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Read the version resource. RAD's file reports RAD Game Tools, Inc. as the company and Bink Video or RAD Video Tools as the description, with a version such as 1.8 or 1.9 in RAD's own numbering. Blank fields or another company point to a replacement, though a careful one copies the text, so this check alone does not clear a file.

   (Get-Item "C:\path\to\binkw32.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

3. Look at what sits next to it. A proxy setup leaves traces: the original under a similar name, a .asi file, a scripts or plugins folder, or a .ini that the loader reads. If you did not install a mod for that game, any of these means someone else modified the folder.
4. Check the digital signature, and read it correctly. A Valid status with RAD or the game's publisher as the signer clears that file. NotSigned is common for genuine older builds and decides nothing alone. HashMismatch means a signed file was changed after signing and is not genuine.

   Get-AuthenticodeSignature "C:\path\to\binkw32.dll" | Format-List Status, SignerCertificate

5. Compare the size and checksum. Use the file check on this page. RAD's copies in the catalogue are about 160 KB to 340 KB. A match identifies a known RAD build; no match is not proof of a fake, because many genuine builds are not listed. A file of several megabytes under this name deserves a scan.

A clean binkw32.dll clears that one file. It says nothing about the .exe, the installer or the other files of a game that came from a repack or a free download, which is where malware from such downloads is usually found.

Do you need binkw32.dll?

Keep every copy inside the games you installed from a store or a disc: without it those games stop at start-up or at the first video. A copy that failed the checks above came with something you did not choose, and the safe way out is to remove that game or download, not only the DLL.

1. Leave genuine game copies alone. A binkw32.dll in a bought game's folder belongs to that game. Deleting it gains nothing and only stops the game from playing its videos or starting at all.
2. Uninstall a game that came from a repack or a free download. Open Settings, Apps, Installed apps, find the game and uninstall it. Repacks often have no uninstaller: then delete the game's whole folder, not only binkw32.dll, because the risky files are usually elsewhere in it.
3. Delete stray copies outside game folders. A binkw32.dll in Downloads, Temp, AppData or System32 is loaded by no game. Note its path, run the scan below first, and delete the file if the scan leaves it in place.
4. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp or AppData.
5. Run the offline scan. Some malware bundled with game downloads hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

6. Change passwords if the download ran an installer you did not trust. Malware bundled with free game downloads is often an information stealer that takes saved browser passwords and session cookies, game store and chat logins included. Change passwords from a clean device and sign out of other sessions.

Warning signs

Known versions of binkw32.dll

A public DLL catalogue lists 43 versions of binkw32.dll, from 1.6a to 1.9.99.0, by RAD Game Tools, Inc.. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix binkw32.dll errors on uGetFix

Questions people ask