d3d9.dll: the genuine Direct3D 9 Runtime, or a copy someone put in your game folder?

What d3d9.dll does, and why other copies of it turn up

d3d9.dll is the Direct3D 9 Runtime, part of Windows since the DirectX 9 era. A game built on Direct3D 9 loads it at start, asks it for a graphics device, and then sends every texture, shader and draw call through it to the graphics driver. Since Windows Vista the same file also provides Direct3D 9Ex, an extended version that works with the desktop compositor. New games use Direct3D 11 or 12 through other files, but Windows 10 and Windows 11 still include and update d3d9.dll so that older games and some desktop programs keep working.

The file is also one of the most common names for proxy DLLs. Because d3d9.dll is not one of the libraries Windows always takes from System32, a game looks in its own folder first. A tool author builds a library with the same name and the same exported functions, puts it next to the game's .exe, and the game loads it at start. Shader and post-processing injectors use this to add effects, graphics enhancers for older games use it to replace lighting, and translation layers such as DXVK ship a d3d9.dll that turns Direct3D 9 into Vulkan. Cheats and overlays use the same trick to draw on top of the game or read its memory.

Whatever the tool, the code runs with the same rights as the game and your user account: it can read and write files, open network connections and start other programs. A legitimate tool does only what its author describes. A repackaged copy, or one that came with a cracked game, can do anything else in the same moment, while still passing the graphics on so the game looks normal.

Windows' own programs can be misused in a similar way. The HijackLibs project lists d3d9.dll as a sideloading target of the Magnifier, magnify.exe: copied out of System32 into another folder together with a planted d3d9.dll, the trusted Microsoft program loads the planted file. So the question is never whether d3d9.dll is a virus, but which d3d9.dll you are looking at.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a game folder d3d9.dll from Windows' copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32, C:\Windows\SysWOW64 and the WinSxS store are Windows' copies. A copy in a game folder is a tool that something installed. A copy anywhere else, or one in a folder that also holds a magnify.exe, needs a closer look.

   Get-ChildItem C:\ -Recurse -Filter d3d9.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the size. Right-click the file, Properties, Details. The genuine file says Direct3D 9 Runtime, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. Its size matches one of the Windows releases in the facts table, between about 1.4 and 2.2 MB. A proxy usually shows another description, another version and another size. A proxy can copy these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer on a game folder copy means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\game\d3d9.dll' | Format-List Status, SignatureType, SignerCertificate

4. What the game loads. Start the game, then open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type d3d9.dll and press Search. The path column shows which copy each running program really loaded. A game folder path means the proxy is running inside the game; any path outside System32 and SysWOW64 inside magnify.exe means a sideloaded file.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A game folder copy that matches is an unneeded Windows copy, often left by an old fix guide; one that does not match is a third-party file.
6. Scan before you trust or delete. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. A detection on a game folder d3d9.dll is not proof either way, because injectors are flagged for how they work, so weigh it with where the mod came from.

A match to a Microsoft build proves the file is Microsoft's. A file that does not match is not automatically malicious: most game folder copies are graphics mods that do what their authors say. What decides is whether you chose to install that mod, from where, and whether the file is the one its author published.

Warning signs and what they mean

Programs that have been made to load a fake d3d9.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted d3d9.dll. Usually the attacker copies the program into another folder and puts a fake d3d9.dll next to it: Windows looks in the program's own folder first. A d3d9.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine d3d9.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine d3d9.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

Source: the HijackLibs entry for d3d9.dll, 1 public report.

Everyday problems with d3d9.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

d3d9.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 229 Microsoft builds in total are known.

Known versions of d3d9.dll

A public DLL catalogue lists 35 versions of d3d9.dll, from 4.9.0.901 to 10.0.19041.488, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix d3d9.dll errors on uGetFix

Questions people ask