dsound.dll: genuine Windows DirectSound file, or a proxy copy in your game folder?

What dsound.dll does, and why games load other copies of it

dsound.dll is the DirectSound library, part of Windows since the early DirectX releases. A game that uses DirectSound loads it to play and mix sound effects and music, and older games also use its 3D sound interface to place sounds around the player. On Windows 10 and Windows 11 the file is still included and updated with every release, so that those games keep their sound.

The file is also a popular name for proxy DLLs. Because dsound.dll is not one of the libraries Windows always takes from System32, a game looks in its own folder first. A tool author builds a library with the same name and the same exported functions, puts it next to the game's .exe, and the game loads it at start.

Two kinds of tools do this openly. Ultimate ASI Loader, an open-source mod loader, is offered under several names, dsound.dll among them, and loads .asi plugin files into the game. DSOAL, an open-source DirectSound replacement, is built as dsound.dll and copied next to the game's executable together with an OpenAL library named dsoal-aldrv.dll; it translates DirectSound calls to OpenAL to bring back 3D sound and EAX effects on PCs without sound hardware that supports them.

Trainers and cheats can use the same route to read and change the game's memory. Whatever the purpose, the code runs with the same rights as the game and your user account: it can read and write files, open network connections and start other programs. A legitimate loader does only what its plugins ask; a malicious one, or a malicious plugin it loads, can steal saved passwords, browser sessions and game accounts in the same way.

So the question is never whether dsound.dll is a virus, but which dsound.dll you are looking at. The two copies in the Windows folders are Microsoft's. A copy in a game folder is whatever the person who made it put into it.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a game folder dsound.dll from Windows' copy

A DLL is not listed in Task Manager as a process, so use the folder, the files next to it, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies, and Windows also keeps copies in its WinSxS store. Every other path, usually a game folder, is a proxy that something installed. If you did not install a mod, sound fix, trainer or tool for that game, find out what did.

   Get-ChildItem C:\ -Recurse -Filter dsound.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. What sits next to it. The neighbouring files usually tell you which tool it is. .asi files, a plugins or scripts folder and an .ini file point to an ASI loader. A dsoal-aldrv.dll next to it points to the DSOAL sound wrapper. A lone dsound.dll in a folder with no mod files, or in a folder with no game at all, deserves the closest look.
3. The Description field and the size. Right-click the file, Properties, Details. The genuine file says DirectSound, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. A proxy usually shows another description, no company or a version that is not a Windows build, and a size that matches no Windows release in the facts table. A proxy can copy these fields, so this check only rules files out.
4. The digital signature. Windows' copy is signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer on a game folder copy means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\game\dsound.dll' | Format-List Status, SignatureType, SignerCertificate

5. What the game loads. Start the game, then open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type dsound.dll and press Search. The path column shows which copy the game really loaded. A game folder path means the proxy is running inside the game.
6. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the 119 known Microsoft builds. A game folder copy that matches is an unneeded Windows copy; one that does not match is a third-party file.
7. Scan before you trust or delete. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. A detection on a game folder dsound.dll is not proof either way, because loaders are flagged for how they work, so weigh it with where the mod came from.

A match to a Microsoft build proves the file is Microsoft's. A file that does not match is not automatically malicious: most game folder copies are ASI loaders or sound wrappers that do exactly what their authors say. What decides is whether you chose to install that mod, from where, and whether the file is the one its author published.

Warning signs and what they mean

Everyday problems with dsound.dll

dsound.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 119 Microsoft builds in total are known.

Known versions of dsound.dll

A public DLL catalogue lists 14 versions of dsound.dll, from 4.8.1.881 to 10.0.14393.0, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix dsound.dll errors on uGetFix

Questions people ask