nvwgf2umx.dll: NVIDIA's DirectX driver file, or a copy that does not belong?

What nvwgf2umx.dll does

Microsoft's Windows Display Driver Model splits a graphics driver into two parts that the card maker supplies: a kernel-mode driver and a user-mode driver. The Direct3D runtime inside a program calls the user-mode driver, which prepares the commands for the graphics card and passes them on through the Windows graphics kernel. nvwgf2umx.dll is NVIDIA's user-mode driver for Direct3D 10 and 11 in 64-bit programs.

Because it runs inside the game, any crash that happens while the driver works on the game's request is reported under the game's name with nvwgf2umx.dll as the faulting module. That makes the file one of the most searched NVIDIA names, and a name people already trust is a convenient one for a planted file. The genuine copy is never loaded from outside the NVIDIA driver's folders, so the location tells most of the story.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of nvwgf2umx.dll

Four questions decide it: where the file is, what it says about itself, who signed it, and how large it is. A library never shows in Task Manager under its own name, so use these checks.

1. List every copy and where it sits. Copies in folders under C:\Windows\System32\DriverStore\FileRepository whose names start with nv_ are normal, sometimes several when Windows keeps older driver packages. A copy in C:\Windows\System32 is normal with older drivers. Look closer at anything in Downloads, Desktop, Temp, AppData or a game folder.

   Get-ChildItem -Path C:\ -Filter nvwgf2umx.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Read the version resource. NVIDIA's file reports NVIDIA Corporation as the company and NVIDIA D3D10 Driver with a release number as the description. Empty or different fields mean the file is not NVIDIA's; matching fields alone do not clear it, because they can be copied.

   (Get-Item "C:\path\to\nvwgf2umx.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

3. Check the digital signature. Status Valid with an NVIDIA signer means an unmodified NVIDIA build. NotSigned, HashMismatch or another signer means the file is not the one NVIDIA shipped, whatever it says about itself. Driver files are sometimes signed through a catalogue file rather than inside the DLL, so test a file that shows NotSigned against a copy in the driver store as well.

   Get-AuthenticodeSignature "C:\path\to\nvwgf2umx.dll" | Format-List Status, SignerCertificate

4. Compare the size. The genuine user-mode driver is many megabytes; the 340.43 copy in the catalogue is about 17.8 MB. A nvwgf2umx.dll of a few hundred kilobytes is not NVIDIA's driver. Use the file check on this page to compare the checksum with the known copy.
5. Find out which program loads a stray copy. If a copy sits outside the driver folders, look for an .exe in the same folder and at Task Manager's Startup apps and Task Scheduler for entries that run from there. A legitimate game never needs its own nvwgf2umx.dll.

A valid NVIDIA signature clears that one file. It says nothing about other files in the same folder, and a planted copy usually comes with a program that does the real work.

Do you need nvwgf2umx.dll?

Keep every copy in the NVIDIA driver's folders: without it no DirectX 10 or 11 program runs on the NVIDIA card. A copy that failed the checks above is not used by the driver, and what matters is the program that brought it.

1. Leave the driver's copies alone. Never delete nvwgf2umx.dll from the driver store or System32 by hand. If the driver is damaged, the NVIDIA driver installer replaces its files; deleting one only breaks graphics in games and other programs.
2. Remove the program that came with a stray copy. Open Settings, Apps, Installed apps, and uninstall the program installed around the time the copy appeared. Then delete the folder that held the stray nvwgf2umx.dll if it stays behind.
3. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds, and look at Protection history for anything found in Downloads, Temp or AppData.
4. Run the offline scan. Malware that hides behind driver names can also hide while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

5. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. Disable and remove entries that run a program from AppData, ProgramData or Temp that you do not recognise, after the scan.
6. Change passwords if you ran an installer you did not trust. When the stray copy came with a free download or a bundle, assume saved browser passwords and sessions may have been read. Change passwords from a clean device and sign out of other sessions.

Warning signs

Known versions of nvwgf2umx.dll

A public DLL catalogue lists 1 versions of nvwgf2umx.dll, from 9.18.13.4043 to 9.18.13.4043, by NVIDIA Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix nvwgf2umx.dll errors on uGetFix

Questions people ask