dxgi.dll: genuine Windows DirectX Graphics Infrastructure, or a proxy copy in your game folder?

What dxgi.dll does, and why games load other copies of it

dxgi.dll is DirectX Graphics Infrastructure, part of Windows since Windows Vista and DirectX 10. Direct3D draws a frame; DXGI decides where it goes. It lists the graphics adapters in the PC and the monitors attached to them, creates the swap chain that holds the frames a program draws, presents each finished frame to the screen and switches between windowed and full screen modes. Direct3D 10, 11 and 12 all go through it, and so does the Desktop Window Manager that draws the Windows desktop.

That position makes the file the favourite name for graphics proxies. Because dxgi.dll is not one of the libraries Windows always takes from System32, a game looks in its own folder first. A tool author builds a library with the same name and the same exported functions, puts it next to the game's .exe, and the game loads it at start. The proxy forwards the real calls to the Windows copy, so the game works normally, and sits exactly where every frame passes on its way to the screen.

Shader and post-processing injectors use this to add effects, upscalers and frame rate tools use it to change the image, translation layers use it to run the game on another graphics interface, and overlays and cheats use it to draw on top of the game or read its memory. The code runs with the same rights as the game and your user account: it can read and write files, open network connections and start other programs. A legitimate mod does only what it says; a malicious one can steal saved passwords, browser sessions and game accounts in the same way.

Windows programs can be misused the same way. The HijackLibs project lists dxgi.dll as a sideloading target for 11 programs in System32, among them Task Manager, the Desktop Window Manager, WinSAT and Quick Assist: copied into another folder together with a planted dxgi.dll, a trusted Microsoft program loads the planted file. So the question is never whether dxgi.dll is a virus, but which dxgi.dll you are looking at and which folder it is in.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a planted dxgi.dll from Windows' copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies, and copies inside C:\Windows\WinSxS belong to Windows' own component store. Every other path is a file that something installed: in a game folder usually a graphics mod, in any other folder a reason to look closer. If you did not install a mod or tool for that game, find out what did.

   Get-ChildItem C:\ -Recurse -Filter dxgi.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. A Windows program next to it. A dxgi.dll in the same folder as a copy of taskmgr.exe, dwm.exe, winsat.exe, quickassist.exe or another program that normally lives in System32 is the sideloading pattern HijackLibs describes. Windows never copies its own programs into user folders. Treat that folder as malicious and scan.
3. The Description field and the size. Right-click the file, Properties, Details. The genuine file says DirectX Graphics Infrastructure, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. A proxy usually shows another description, no company or a version that is not a Windows build, and a size that matches no Windows release in the facts table. A proxy can copy these fields, so this check only rules files out.
4. The digital signature. Windows' copy is signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer on a game folder copy means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\game\dxgi.dll' | Format-List Status, SignatureType, SignerCertificate

5. What the program loads. Start the game, then open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type dxgi.dll and press Search. The path column shows which copy each process really loaded. dwm.exe and other Windows processes should show System32; a game folder path means the proxy is running inside the game.
6. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A game folder copy that matches is an unneeded Windows copy; one that does not match is a third-party file.

A match to a Microsoft build proves the file is Microsoft's. A file that does not match is not automatically malicious: most game folder copies are graphics mods that do exactly what their authors say. What decides is whether you chose to install that mod, from where, and whether the file is the one its author published.

Warning signs and what they mean

Programs that have been made to load a fake dxgi.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted dxgi.dll. Usually the attacker copies the program into another folder and puts a fake dxgi.dll next to it: Windows looks in the program's own folder first. A dxgi.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine dxgi.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine dxgi.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

and 1 more programs. Source: the HijackLibs entry for dxgi.dll, 3 public reports.

Everyday problems with dxgi.dll

dxgi.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 300 Microsoft builds in total are known.

Known versions of dxgi.dll

A public DLL catalogue lists 21 versions of dxgi.dll, from 6.0.6000.16386 to 10.0.19041.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix dxgi.dll errors on uGetFix

Questions people ask