isdone.dll: an installer's unpacking plugin, or a sign of a risky download?

What isdone.dll does

Inno Setup, a free installer builder, lets the author of a setup add helper files that the setup extracts to its own temporary folder and calls while it runs. Inno Setup's documentation describes that folder: a subfolder of the user's temporary directory with a name like IS-xxxxx.tmp, deleted with everything in it when Setup exits. isdone.dll is one such helper. It opens the installer's external data files, passes them to unpacking libraries such as FreeArc's unarc.dll, tracks progress and shows a window when a step fails.

The technique keeps huge games small to download, which is why it became standard in repacked game installers. That is the reason isdone.dll is so strongly linked to cracked games and why security programs flag the name often. The plugin does the same work in either case. What differs is the installer around it: a repack comes from an unknown third party, its contents may be modified, and such downloads are a common way to deliver information stealers and other malware. The sister file unarc.dll has its own page with the same angle.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of isdone.dll

A library never shows in Task Manager under its own name, and this one carries no publisher details to verify. Four questions decide it: where the file is, which download brought it, whether anything starts it, and what a scan of the whole download finds.

1. List every copy and where it sits. A copy in an IS-....tmp folder under Temp while a setup runs, or in a program folder you installed yourself, is expected. Look closer at copies in System32, SysWOW64, AppData, ProgramData or a folder with nothing else in it.

   Get-ChildItem -Path C:\ -Filter isdone.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Find out which download brought it. Look at the folder the copy sits in and at the installer that created it. A setup from a developer or an official store is a normal source. A repacked or cracked game installer is not, and then the whole download is what needs checking, not the DLL.
3. Check that nothing starts it. isdone.dll has no reason to run when Windows starts. Search the startup entries and scheduled tasks for its name. A Run key or task that loads it through rundll32 or a script points to a planted copy.

   Get-CimInstance Win32_StartupCommand | Where-Object { $_.Command -match 'isdone' } | Select-Object Name, Command, Location; Get-ScheduledTask | Where-Object { ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'isdone' }

4. Read the version resource and the size. A blank company and description are normal for this plugin, so they neither clear nor condemn a copy. A copy several megabytes in size, or one that claims to be a Microsoft file, is not the installer plugin.

   (Get-Item "C:\path\to\isdone.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion; (Get-Item "C:\path\to\isdone.dll").Length; Get-AuthenticodeSignature "C:\path\to\isdone.dll"

5. Scan the download, not only the DLL. Run a Microsoft Defender custom scan on the installer's folder and on the installed game's folder. A detection on the setup .exe, a patched game .exe or an extra program in the download matters more than one on isdone.dll.

A clean isdone.dll says nothing about the rest of a repacked download. The installer, a modified game .exe or an extra program set to start with Windows is where malware from such downloads usually sits.

Do you need isdone.dll?

No installed game or program needs isdone.dll once its setup has finished. A copy left in a program folder you installed from its developer is harmless and can stay or go. A copy that came with a repacked or cracked game is a reason to remove that game, not only the DLL.

1. Leave a running installer alone. During a setup from a trusted source, the copy in the Temp folder is in use. Inno Setup deletes its temporary folder when Setup exits; if one stays behind after an aborted install, empty the Temp folder after a restart.
2. Uninstall a game that came as a repack or crack. Open Settings, Apps, Installed apps, find the game and uninstall it. Repacks often have no proper uninstaller or leave files behind: then delete the game's whole folder and the installer files you downloaded.
3. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds, and look at Protection history for anything found in Downloads, Temp or AppData.
4. Run the offline scan. Some malware bundled with game downloads hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

5. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. Disable and remove entries you do not recognise that run a program from AppData, ProgramData or Temp, and any that mention isdone.dll.
6. Change passwords if you ran an installer you did not trust. Malware bundled with free game downloads is often an information stealer that takes saved browser passwords and session cookies, game store and chat logins included. Change passwords from a clean device and sign out of other sessions.
7. Get the game from its official store. A cracked or repacked copy stays a security risk however well it installs. The clean way to play is the game from its official store, where the launcher downloads and checks every file.

Warning signs

Known versions of isdone.dll

A public DLL catalogue lists 2 versions of isdone.dll, from 0.5.0.0 to 0.6.0.0, by Unknown. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix isdone.dll errors on uGetFix

Questions people ask