dinput8.dll: genuine Windows DirectInput file, or a proxy copy in your game folder?

What dinput8.dll does, and why games load other copies of it

dinput8.dll is the DirectInput 8 library, part of Windows since the DirectX 8 era. A game that uses DirectInput loads it to read the keyboard, the mouse, joysticks, steering wheels and force feedback devices. Microsoft's documentation treats DirectInput devices as legacy and presents XInput and GameInput as the interfaces for new games, but Windows 10 and Windows 11 still include and update dinput8.dll so that older games keep working.

The file is also the most popular name for proxy DLLs. Because dinput8.dll is not one of the libraries Windows always takes from System32, a game looks in its own folder first. A tool author builds a library with the same name and the same exported functions, puts it next to the game's .exe, and the game loads it at start. The proxy forwards the real input calls to the Windows copy, so the game works normally, and in the same moment runs the tool's own code inside the game.

Mod loaders use this to load plugin files (often .asi or .dll files from a plugins folder), graphics injectors use it to add effects, and trainers and cheats use it to read and change the game's memory. The code runs with the same rights as the game and your user account: it can read and write files, open network connections and start other programs. A legitimate loader does only what its plugins ask; a malicious one, or a malicious plugin it loads, can steal saved passwords, browser sessions and game accounts in the same way.

So the question is never whether dinput8.dll is a virus, but which dinput8.dll you are looking at. The two copies in the Windows folders are Microsoft's. A copy in a game folder is whatever the person who made it put into it.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a game folder dinput8.dll from Windows' copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies. Every other path, usually a game folder, is a proxy that something installed. If you did not install a mod, trainer or tool for that game, find out what did.

   Get-ChildItem C:\ -Recurse -Filter dinput8.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the size. Right-click the file, Properties, Details. The genuine file says Microsoft DirectInput, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. A proxy usually shows another description, no company or a version that is not a Windows build, and a size that matches no Windows release in the facts table. A proxy can copy these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer on a game folder copy means a third-party loader.

   Get-AuthenticodeSignature 'C:\path\to\game\dinput8.dll' | Format-List Status, SignatureType, SignerCertificate

4. What the game loads. Start the game, then open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type dinput8.dll and press Search. The path column shows which copy the game really loaded. A game folder path means the proxy is running inside the game.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A game folder copy that matches is an unneeded Windows copy; one that does not match is a third-party file.
6. Scan before you trust or delete. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. A detection on a game folder dinput8.dll is not proof either way, because loaders are flagged for how they work, so weigh it with where the mod came from.

A match to a Microsoft build proves the file is Microsoft's. A file that does not match is not automatically malicious: most game folder copies are mod loaders that do exactly what their authors say. What decides is whether you chose to install that mod, from where, and whether the file is the one its author published.

Warning signs and what they mean

Everyday problems with dinput8.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

dinput8.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 46 Microsoft builds in total are known.

Known versions of dinput8.dll

A public DLL catalogue lists 16 versions of dinput8.dll, from 4.8.0.400 to 10.0.15063.608, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix dinput8.dll errors on uGetFix

Questions people ask