libcurl.dll: the curl network library, or a file planted next to a signed program?

What libcurl.dll does

The curl project describes libcurl as a free and easy-to-use client-side URL transfer library. It speaks HTTP, HTTPS, FTP, SFTP, SMTP, IMAP and many other protocols, handles proxies, cookies, certificates and logins, and is the library behind the curl command-line tool. Developers build it into their programs, and on Windows the result is often a libcurl.dll in the program's folder. The program calls it for update checks, downloads, uploads and sign-ins. Windows includes the curl tool, but programs that need libcurl.dll bring their own.

Because a program loads libcurl.dll from its own folder by name, the file is a target for DLL sideloading. An attacker copies a legitimate, signed program that uses libcurl into a folder of their choice and puts a malicious libcurl.dll beside it. Windows starts the signed program, and the program loads the attacker's file with its trusted name. HijackLibs lists two such programs with their hashes: GUP.exe, the WinGup updater for Notepad++ signed by Notepad++, and the FileProcessManager module of Coolmuster PDF Creator Pro.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of libcurl.dll

Five questions decide it: where the file is, what sits next to it, what it says about itself, who signed it and how large it is. A library never shows in Task Manager under its own name, so use these checks.

1. List every copy and where it sits. Copies under Program Files, Program Files (x86), WindowsApps or a program's folder in AppData\Local are normal, one per program that uses libcurl. Look closer at copies in Downloads, Desktop, Temp, C:\Users\Public, ProgramData or a folder with a random name.

   Get-ChildItem -Path C:\ -Filter libcurl.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Look at what sits next to it. A genuine copy shares its folder with the rest of a program: its .exe, settings files and often other libraries. A libcurl.dll beside a single signed .exe such as GUP.exe, far from the Notepad++ folder, with nothing else or with one unknown data file, is the pattern of a planted loader.
3. Read the version resource. A curl build usually describes itself as libcurl Shared Library and names the curl library as the company, while Apple's builds name Apple Inc. A planted file can copy these text fields, so this check alone does not clear a file, but an empty or unrelated description is a warning.

   (Get-Item "C:\path\to\libcurl.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

4. Check the digital signature. A program's maker may sign the libcurl.dll it ships. Status Valid with that maker's name is a good sign. NotSigned is common for open-source builds inside a program folder, but on a copy outside any program you installed, NotSigned or HashMismatch means you should treat it as hostile. A signed .exe next to it proves nothing about the DLL.

   Get-AuthenticodeSignature "C:\path\to\libcurl.dll" | Format-List Status, SignerCertificate

5. Compare the size and checksum. Use the file check on the uGetFix page for libcurl.dll. The 32-bit copies in the public catalogue range from about 215 KB to 614 KB. A match identifies a known build; no match is not proof of a fake, because most genuine builds are not listed. Folder and signature decide.

A valid signature clears that one file. It says nothing about the other files in the folder: in a sideloading attack the malicious code is often in a second, encrypted file that the fake DLL only decrypts and starts.

Do you need libcurl.dll?

Keep every copy inside the programs you installed: without it those programs cannot check for updates or download anything, and some do not start at all. A copy that failed the checks above belongs to no program you use, and the safe way out is to remove the whole folder it came with and scan the PC.

1. Leave the copies of installed programs alone. A copy in a program's install folder belongs to that program. If it is damaged, flagged or reported as outdated, the program's update, repair or reinstall replaces its own copy; deleting it only breaks the program.
2. Uninstall a program you do not recognise. Open Settings, Apps, Installed apps, look for a program you did not install around the date the file appeared, and uninstall it. If the libcurl.dll sits in a folder no installed program uses, end any process started from that folder in Task Manager and delete the whole folder, not only the DLL.
3. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp, AppData or ProgramData.
4. Run the offline scan. Loaders started through sideloading often install further malware that hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

5. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. After the scan, disable and remove entries that start a program such as GUP.exe from AppData, ProgramData, Temp or C:\Users\Public, or any entry you do not recognise.
6. Change passwords if a planted copy ran. Code that runs inside a trusted process can read what your account can read, including saved browser passwords and session cookies. Change your important passwords from a clean device and sign out of other sessions.

Warning signs

Programs that have been made to load a fake libcurl.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted libcurl.dll. Usually the attacker copies the program into another folder and puts a fake libcurl.dll next to it: Windows looks in the program's own folder first. A libcurl.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine libcurl.dll belongs: C:\Program Files\Notepad++\updaterC:\Program Files\WindowsApps\MSTeams_<version>C:\Program Files\Coolmuster\Coolmuster PDF Creator Pro\<version>\Bin

Source: the HijackLibs entry for libcurl.dll, 2 public reports.

Known versions of libcurl.dll

A public DLL catalogue lists 8 versions of libcurl.dll, from 7.13.0.0 to 10.2.0.232, by Apple Inc.. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix libcurl.dll errors on uGetFix

Questions people ask