Is d3dx9_43.dll safe? Telling Microsoft's D3DX9 file from a fake that uses its name

What d3dx9_43.dll does

Direct3D 9 is the part of Windows that draws 3D graphics for older games. D3DX9 is Microsoft's helper library on top of it: functions for matrix and vector math, loading textures and 3D models from files, compiling shaders, and drawing text and sprites. Microsoft released a new D3DX9 file with each DirectX SDK update, from d3dx9_24.dll to d3dx9_43.dll. The 43 marks the final one, from June 2010.

The genuine file imports only four core Windows libraries and contains nothing that starts on its own. Its risk is the name. Many games and some other programs load d3dx9_43.dll from their own folder, so whoever controls that folder can put a different file there under the same name. The trusted program then runs that file's code with its own reputation and signature. Security researchers call this DLL side-loading.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of d3dx9_43.dll

Three things decide it: where the copy is, who signed it, and which program loads it. A DLL never appears in Task Manager by its own name, so use these steps.

1. Find every copy on the drive. Run this in PowerShell. Copies in System32 and SysWOW64 belong to the runtime. A copy inside a game's install folder is common. A copy in AppData, ProgramData, Temp or Downloads, or next to an .exe that is not a game, is the one to look at closely.

   Get-ChildItem -Path C:\ -Filter d3dx9_43.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Read the digital signature. A genuine file shows Status Valid and Microsoft Corporation as signer. NotSigned or any other signer means the file is not Microsoft's. HashMismatch means a Microsoft file was altered after it was signed.

   Get-AuthenticodeSignature "C:\path\to\d3dx9_43.dll" | Format-List Status, SignerCertificate

3. Compare size and version. Microsoft's file is version 9.29.952.3111 and 2,401,112 bytes (x64) or 1,998,168 bytes (x86). A file of very different size under this name is not the June 2010 library. Open Properties, Details to see the version and description.
4. See which program has it loaded. In Process Explorer (Microsoft Sysinternals) choose Find, Find Handle or DLL, and type d3dx9_43.dll. The result shows each process and the path of the copy it loaded. A non-game program loading d3dx9_43.dll from a user or ProgramData folder is a strong sign of side-loading.
5. Look at the files around it. In the reported cases the fake d3dx9_43.dll sat beside a renamed or unfamiliar executable and data files with meaningless names. A copy that arrived with a cracked or repacked game installer deserves a scan, even if the game itself runs.

A valid Microsoft signature proves the file is genuine, but not that the program loading it is. An unsigned copy is not always malware, yet nothing explains it except the program that placed it.

Do you need d3dx9_43.dll?

Keep the signed copies in the Windows folders: older games stop starting without them. Remove an unexplained copy only together with the program that brought it.

1. Keep the System32 and SysWOW64 copies. When they are signed by Microsoft they belong to the DirectX runtime and harm nothing. Deleting them breaks games that need D3DX9.
2. Set aside a suspicious copy before deleting it. Move an unsigned copy from a non-game folder to a quarantine folder of your own, so you can restore it if a legitimate tool turns out to need it.
3. Run a Microsoft Defender full scan. Windows Security, Virus and threat protection, Scan options, Full scan. Let Defender quarantine what it finds before removing files by hand.
4. Run the offline scan. Loaders that inject into other processes can hide while Windows runs. The offline scan restarts the PC and scans before Windows starts, in about 15 minutes.

   Start-MpWDOScan

5. Remove what came with it. Uninstall the program or cracked game from Settings, Apps, Installed apps, delete its folder, and look in Settings, Apps, Startup, in Task Scheduler and on the Desktop for shortcuts or tasks that start a file from the same folder.
6. Change passwords if it was a stealer loader. The 2026 chain ended in an information stealer that targets saved browser data. From a clean device, change e-mail, banking and game account passwords and sign out of other sessions.

Warning signs

How attackers have used the name d3dx9_43.dll

Two published reports name a malicious d3dx9_43.dll. In both, the genuine Microsoft file was not involved: the attackers shipped their own DLL under this name for a legitimate program to load.

MITRE ATT&CK lists this as Hijack Execution Flow: DLL Side-Loading (T1574.002). The useful test on a home PC is the folder and the signer, not the name: a malicious d3dx9_43.dll keeps the genuine file name.

Programs that have been made to load a fake d3dx9_43.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted d3dx9_43.dll. Usually the attacker copies the program into another folder and puts a fake d3dx9_43.dll next to it: Windows looks in the program's own folder first. A d3dx9_43.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine d3dx9_43.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine d3dx9_43.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

Source: the HijackLibs entry for d3dx9_43.dll, 1 public report.

Known versions of d3dx9_43.dll

A public DLL catalogue lists 5 versions of d3dx9_43.dll, from 9.29.952.3111 to 9.29.952.3111, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix d3dx9_43.dll errors on uGetFix

Questions people ask