d3d11.dll: genuine Windows Direct3D 11 file, or a copy planted next to a program?

What d3d11.dll does, and why programs load other copies of it

d3d11.dll is the Direct3D 11 Runtime. A game or program creates a Direct3D 11 device through it, sends it textures, shaders and draw calls, and the runtime hands that work to the graphics driver. Direct3D 11 is one of the most used graphics interfaces on Windows, so the file is loaded not only by games but also by browsers, video players, and Windows tools such as Task Manager and the Desktop Window Manager.

d3d11.dll is not one of the libraries Windows always takes from System32, so a program looks in its own folder first. That makes the name popular for proxy DLLs. A graphics mod builds a library with the same name and the same exported functions, puts it next to the game's .exe, and the game loads it at start. The proxy forwards the real calls to the Windows copy and in the same moment runs its own code inside the game: shader effects, upscaling, a translation of Direct3D 11 to another graphics interface, or, in the case of cheats, reading and changing the game's memory.

The same rule is a known attack technique, DLL search order hijacking. HijackLibs, a public list of DLL hijacking research, records 13 programs that load d3d11.dll in a way that can be abused: 12 Windows programs from System32, among them Task Manager (taskmgr.exe), WinSAT (winsat.exe), Quick Assist (quickassist.exe) and the Desktop Window Manager (dwm.exe), and one third-party desktop wallpaper program. An attacker copies a signed program like these into a writable folder, puts a malicious d3d11.dll beside it, and the trusted program runs the attacker's code. HijackLibs notes that Task Manager, WinSAT and systemreset.exe can start with administrator rights without a prompt, which makes such a pair more dangerous.

So the question is never whether d3d11.dll is a virus, but which d3d11.dll you are looking at. The two copies in the Windows folders are Microsoft's. A copy anywhere else is whatever the person who made it put into it.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a planted d3d11.dll from Windows' copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies, and copies inside C:\Windows\WinSxS are Windows' stored originals. A copy in a game folder is usually a graphics mod. A copy in AppData, Temp, ProgramData or Downloads, especially next to a Windows program such as taskmgr.exe or winsat.exe, has no normal reason to exist.

   Get-ChildItem C:\ -Recurse -Filter d3d11.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the size. Right-click the file, Properties, Details. The genuine file says Direct3D 11 Runtime, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. It is about 2.5 MB. A mod's copy usually shows another description, no company or a version that is not a Windows build, and a size that matches no Windows release in the facts table. A planted file can copy these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\folder\d3d11.dll' | Format-List Status, SignatureType, SignerCertificate

4. What the program loads. Start the program, then open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type d3d11.dll and press Search. The path column shows which copy each program really loaded. Any path outside the Windows folders means a proxy or a planted file is running inside that program.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A copy that matches is an unneeded Windows copy; one that does not match is a third-party file.
6. Scan before you trust or delete. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. A detection on a game folder d3d11.dll is not proof either way, because graphics injectors are flagged for how they work, so weigh it with where the mod came from.

A match to a Microsoft build proves the file is Microsoft's. A file that does not match is not automatically malicious: most game folder copies are graphics mods that do what their authors say. What decides is where the file sits, whether you chose to install it, and from where.

Warning signs and what they mean

Programs that have been made to load a fake d3d11.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted d3d11.dll. Usually the attacker copies the program into another folder and puts a fake d3d11.dll next to it: Windows looks in the program's own folder first. A d3d11.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine d3d11.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine d3d11.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

and 3 more programs. Source: the HijackLibs entry for d3d11.dll, 4 public reports.

Everyday problems with d3d11.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

d3d11.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 289 Microsoft builds in total are known.

Known versions of d3d11.dll

A public DLL catalogue lists 34 versions of d3d11.dll, from 6.1.7600.16385 to 10.0.19041.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix d3d11.dll errors on uGetFix

Questions people ask