dbghelp.dll: genuine Windows Image Helper, a program's own copy, or a planted fake?

What dbghelp.dll does, and why there are so many copies of it

dbghelp.dll is the DbgHelp library. A program calls it when something has gone wrong: to save a minidump file of its memory, to walk the call stack of a thread and to translate raw addresses into function names and source lines with the help of debug symbols. Windows Error Reporting uses it, and so do debuggers, profilers and the crash reporters built into games and applications.

Microsoft documents that the copy in Windows is rarely the newest DbgHelp and lacks Symbol Server and Source Server support, and that this copy is not redistributable. Developers who need more ship the version from the Debugging Tools for Windows inside their own program folder. That is why a signed Microsoft dbghelp.dll with a version that matches no Windows release is often perfectly normal in a program folder.

The same habit makes the name useful to attackers. A program that loads dbghelp.dll looks in its own folder first. The HijackLibs project lists 17 programs from System32, among them werfault.exe, taskkill.exe, tasklist.exe and tracerpt.exe, that load a dbghelp.dll placed beside them when they are copied to another folder, or when the WINDIR environment variable is pointed elsewhere. The program is genuine and signed by Microsoft; the DLL it loads is not, and its code runs with the program's rights and under its trusted name.

So the question is not whether dbghelp.dll is a virus, but which dbghelp.dll you are looking at and which program sits next to it. Windows' own copies and the copies inside programs you installed are expected. A copy in a folder that holds only a lone Windows executable, or no program at all, is not.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a genuine dbghelp.dll from a planted one

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is, and what sits next to it. List every copy with the command below. System32 and SysWOW64 are Windows' copies. A copy inside the folder of a program you installed, such as Windows Kits, Microsoft Office or a game, is that program's own build. A copy next to a copied Windows tool such as werfault.exe, in Temp, Downloads or the root of AppData, is the pattern that sideloading uses.

   Get-ChildItem C:\ -Recurse -Filter dbghelp.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Version';e={$_.VersionInfo.FileVersion}}

2. The Description field and the size. Right-click the file, Properties, Details. Microsoft's copies say Windows Image Helper, with Microsoft Corporation as the company. Windows' own copy has a version such as 10.0.26100 and a size from the facts table; a Debugging Tools copy has another version and size and is still genuine. A fake can copy these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. Copies that programs ship are usually signed inside the file. PowerShell reads both kinds. Valid with a Microsoft signer means Microsoft built it; NotSigned or an unknown signer means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\dbghelp.dll' | Format-List Status, SignatureType, SignerCertificate

4. Which program loads it. Open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type dbghelp.dll and press Search. The list shows every running process that has the file loaded and from which path. A Windows program such as werfault.exe or taskkill.exe running from a folder outside System32 with a dbghelp.dll beside it deserves a close look.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with 132 known Windows builds of the file. A match is Windows' own file. A program folder copy that does not match can still be a genuine Debugging Tools build, so read its signature too.
6. Scan before you trust or delete. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. Keep in mind that a copy inside a known program is part of that program and that removing it breaks the program's crash reporting, not Windows.

A match to a Windows build proves the file is Microsoft's, and a valid Microsoft signature proves Microsoft built a program folder copy. A file that has neither is not automatically malicious, but in a folder with no program you installed, or beside a lone copied Windows tool, it has no normal reason to exist.

Warning signs and what they mean

Programs that have been made to load a fake dbghelp.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted dbghelp.dll. Usually the attacker copies the program into another folder and puts a fake dbghelp.dll next to it: Windows looks in the program's own folder first. A dbghelp.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine dbghelp.dll belongs: C:\Program Files\windows kits\10\debuggers\armC:\Program Files\windows kits\10\debuggers\arm\srcsrvC:\Program Files\windows kits\10\debuggers\arm64C:\Program Files\windows kits\10\debuggers\arm64\srcsrvC:\Program Files\windows kits\10\debuggers\x64C:\Program Files\windows kits\10\debuggers\x64\srcsrvC:\Program Files\windows kits\10\debuggers\x86C:\Program Files\windows kits\10\debuggers\x86\srcsrvC:\Program Files\cisco systems\cisco jabberC:\Program Files\microsoft office\root\office<version>C:\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140C:\Windows\System32C:\Windows\SysWOW64

The genuine dbghelp.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

and 7 more programs. Source: the HijackLibs entry for dbghelp.dll, 4 public reports.

Everyday questions about dbghelp.dll copies

dbghelp.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 132 Microsoft builds in total are known.

Known versions of dbghelp.dll

A public DLL catalogue lists 54 versions of dbghelp.dll, from 5.1.2600.0 to 10.0.18362.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix dbghelp.dll errors on uGetFix

Questions people ask