steam_api.dll: Valve's 32-bit Steam library, a crack's emulator, or malware?

What steam_api.dll does

steam_api.dll is the 32-bit library of the Steamworks API. Valve hands it to game developers with the Steamworks SDK, and its documentation tells them to ship it in the game's run-time directory, next to the executable or in the game's DLL search path. When the game starts it asks the library to connect to the Steam client running on the PC, and Steam then provides achievements, cloud saves, friends, invites, workshop items, multiplayer and the overlay.

Through the library the game also learns whether it was started with Steam and whether the signed-in account owns it. That is exactly what a crack has to defeat, and the easiest way is to replace steam_api.dll with a Steam emulator: a file with the same name and the same functions that answers the game itself and never asks Steam. Because Windows loads the steam_api.dll it finds in the game's folder first, whatever file sits there under that name runs inside the game. The emulator is not malware by itself, but it is not Valve's file, and the download that delivered it decides whether the PC is safe.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of steam_api.dll

Four questions decide it: where the file is, what it says about itself, who signed it, and what lies next to it. A library never appears in Task Manager under its own name, so use these checks instead.

1. List every copy and where it sits. Copies under a Steam library's steamapps\common folder are normal, one per 32-bit game. Look closer at copies in Downloads, Desktop, Temp, AppData, the Windows folders, or a game folder outside any Steam library.

   Get-ChildItem -Path C:\ -Filter steam_api.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Read the version resource. Valve's file reports Valve Corporation as the company and Steam Client API as the description. Many emulators leave these fields empty or different, but a careful one copies them, so this check alone never clears a file.

   (Get-Item "C:\path\to\steam_api.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

3. Check the digital signature. Status Valid with a Valve signer means an unmodified Valve build. NotSigned, HashMismatch or another signer means the file is not Valve's as shipped. Text fields can be copied; a valid signature cannot.

   Get-AuthenticodeSignature "C:\path\to\steam_api.dll" | Format-List Status, SignerCertificate

4. Look at what lies next to it. Steam emulators usually bring their own configuration: a .ini file, a steam_settings or similar folder, or the original library kept under another name such as steam_api.dll.bak or steam_api_o.dll. Any of these means the game folder was cracked or modified. A steam_appid.txt is a developer test file that Valve tells developers to remove before release; in a game from outside Steam it adds to the doubt.
5. Compare the size and checksum. Use the file check on this page. Valve's 32-bit builds in the catalogue range from about 100 KB to 260 KB. A match identifies a known Valve copy; no match is not proof of a fake, because many Valve builds are not listed. The signature check above is the one that decides.

A valid Valve signature clears that one file and nothing else. It says nothing about the .exe, the installer or the other files that came with a cracked game, which is where malware from such downloads is usually found.

Do you need steam_api.dll?

Keep every copy inside the Steam games you installed: without it the game does not start. A copy that failed the checks above belongs to a game you got somewhere else, and the safe way out is to remove that whole game, not only the DLL.

1. Leave Steam games alone. A copy in a steamapps\common game folder belongs to that game. Deleting it only stops the game from starting, and Steam can put Valve's copy back for that game if it was ever damaged or flagged.
2. Uninstall a game that did not come from Steam. Open Settings, Apps, Installed apps, find the game and uninstall it. Repacks and free downloads often have no uninstaller: then delete the game's whole folder, not only steam_api.dll, and the installer you downloaded.
3. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp or AppData.
4. Run the offline scan. Some malware bundled with game downloads hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

5. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. After the scan, disable and remove entries that run a program from AppData, ProgramData or Temp that you do not recognise.
6. Change passwords if the download ran an installer you did not trust. Malware bundled with free game downloads is often an information stealer that takes saved browser passwords and session cookies, Steam and Discord logins included. Change passwords from a clean device and sign out of all other sessions.

Warning signs

Known versions of steam_api.dll

A public DLL catalogue lists 43 versions of steam_api.dll, from 0.89.39.43 to 7.9.87.40, by Valve Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix steam_api.dll errors on uGetFix

Questions people ask