shell32.dll: genuine Windows Shell file, or a copy that does not belong there?

What shell32.dll does, and why a copy elsewhere is a warning sign

shell32.dll is one of the oldest Windows libraries. File Explorer runs on it to show folders and files, the desktop uses it for icons and shortcuts, and programs call it every time they show an Open or Save dialog, a folder picker or a file's icon. It also loads the shell extensions that other programs register, such as right-click menu entries and thumbnail handlers, which is why it shows up in so many crash reports that are really about someone else's add-on.

Windows treats shell32.dll as one of its known DLLs: when a program loads it in the normal way, Windows takes the copy from System32 and ignores a file with the same name in the program's folder. That protects most programs from a planted copy. It does not protect every path. HijackLibs lists nine Windows programs, among them notepad.exe, mstsc.exe, control.exe and certreq.exe, that can be made to load shell32.dll from another folder when the SYSTEMROOT environment variable of the starting process is changed, a technique described in Wietze Beukema's research on environment variables.

For an attacker, that is a way to run their own code inside a program signed by Microsoft, which looks less suspicious to a person reading a process list. The planted library usually sits in a folder the user can write to, such as AppData or Temp, together with a copy of the program or a script that starts it with the changed variable.

The name shell32.dll is also simply a good disguise. A file called shell32.dll in a Downloads or AppData folder looks like part of Windows to anyone who does not know where Windows keeps it. So the question is never whether shell32.dll is a virus, but which shell32.dll you are looking at: the copies in the Windows folders are Microsoft's, and any other copy is whatever the person who put it there made it to be.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell Windows' shell32.dll from a copy that does not belong

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell and Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32, C:\Windows\SysWOW64 and C:\Windows\System32\forwarders are Windows' copies. Copies inside C:\Windows\WinSxS belong to Windows' component store. Every other path is a file that something else put there.

   Get-ChildItem C:\ -Recurse -Filter shell32.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the size. Right-click the file, Properties, Details. The genuine file says Windows Shell Common Dll, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. Compare the size with the facts table for your release. A planted copy can imitate these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer on a copy outside the Windows folders means it is not Windows' file. The small forwarders copy is not signed on some builds, but its folder identifies it.

   Get-AuthenticodeSignature 'C:\path\to\shell32.dll' | Format-List Status, SignatureType, SignerCertificate

4. What a program really loaded. Open Process Explorer from Microsoft Sysinternals, choose Find, Find Handle or DLL, type shell32.dll and press Search. The path column shows which copy each running process loaded. Every path should be in C:\Windows\System32 or C:\Windows\SysWOW64; a process that loaded shell32.dll from AppData, Temp or a user folder is running a planted copy.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A copy outside Windows that matches is an unneeded Windows file someone copied there; one that does not match is not Microsoft's file.
6. Scan before you trust or delete. Run a full scan in Windows Security, and the offline scan if a detection keeps coming back. Then look at what is next to the file: a copied Windows program, a script or a scheduled task in the same folder tells you how it was meant to start.

A match to a Microsoft build proves the file is Microsoft's, but not that it is in the right place: a genuine shell32.dll copied into AppData next to a Windows program can still be part of an attack. A copy outside the Windows folders that does not match is not Windows' file. What decides is the folder, what sits next to it, and what started it.

Warning signs and what they mean

Programs that have been made to load a fake shell32.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted shell32.dll. Usually the attacker copies the program into another folder and puts a fake shell32.dll next to it: Windows looks in the program's own folder first. A shell32.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine shell32.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine shell32.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

Source: the HijackLibs entry for shell32.dll, 1 public report.

Everyday problems with shell32.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

shell32.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 1727 Microsoft builds in total are known.

Known versions of shell32.dll

A public DLL catalogue lists 38 versions of shell32.dll, from 4.72.3812.600 to 10.0.19041.572, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix shell32.dll errors on uGetFix

Questions people ask