opengl32.dll: genuine Windows OpenGL file, or a copy that a program loads instead?

What opengl32.dll does, and why programs load other copies of it

opengl32.dll is Microsoft's OpenGL library for Windows. OpenGL is a graphics interface for 2D and 3D drawing, used by games, CAD and 3D software, emulators and creative tools. Microsoft documents its own OpenGL implementation as version 1.1. A program that uses OpenGL loads opengl32.dll, which loads the OpenGL driver of the graphics card and passes the work to it. Newer OpenGL functions are not exported by opengl32.dll at all: programs ask the driver for them through wglGetProcAddress. Without a graphics driver, the file draws with its own software renderer, which programs report as GDI Generic.

Because opengl32.dll is not one of the libraries Windows always takes from System32, a program looks in its own folder first. That makes the name useful to anyone who wants to run code inside an OpenGL program. A file with the same name and the same exported functions, put next to the .exe, is loaded at start in place of Windows' copy.

Several kinds of legitimate tools do this. Software OpenGL renderers are built as opengl32.dll so that a program can run on a PC or virtual machine without a working graphics driver. Graphics wrappers for old games and post-processing injectors use the name to add effects or translate calls to another graphics interface. Some programs ship such a file in their own folder for the same reason.

The same position is open to harmful code. A copy in a program folder runs with the rights of that program and your user account: it can read and write files, open network connections and start other programs, while still passing the drawing on so that the program looks normal. So the question is never whether opengl32.dll is a virus, but which opengl32.dll you are looking at. The two copies in the Windows folders are Microsoft's; any other copy is whatever the person who made it put into it.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a program folder opengl32.dll from Windows' copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies. Every other path, usually a program or game folder, is a file that something added. If you did not install a renderer, wrapper or graphics tool for that program, and the program's own installer did not put it there, find out what did.

   Get-ChildItem C:\ -Recurse -Filter opengl32.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the size. Right-click the file, Properties, Details. The genuine file says OpenGL Client DLL, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. A third-party copy usually shows another description, another company or a version that is not a Windows build, and a size that matches no Windows release in the facts table. These fields can be copied, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft through a catalog rather than inside the file, so the Properties window shows no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer on a program folder copy means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\program\opengl32.dll' | Format-List Status, SignatureType, SignerCertificate

4. What the program loads. Start the program, then open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type opengl32.dll and press Search. The path column shows which copy each process really loaded. A program folder path means that copy is running inside the program.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A program folder copy that matches is an unneeded Windows copy; one that does not match is a third-party file.
6. Scan before you trust or delete. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. A detection on a program folder opengl32.dll is not proof either way, because injectors are flagged for how they work, so weigh it with where the file came from.

A match to a Microsoft build proves the file is Microsoft's. A file that does not match is not automatically malicious: most program folder copies are renderers or graphics tools that do what their authors say. What decides is whether you or the program's installer chose to add that file, from where, and whether it is the one its author published.

Warning signs and what they mean

Everyday problems with opengl32.dll

opengl32.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 171 Microsoft builds in total are known.

Known versions of opengl32.dll

A public DLL catalogue lists 18 versions of opengl32.dll, from 5.1.2600.2180 to 10.0.17134.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix opengl32.dll errors on uGetFix

Questions people ask