unarc.dll: an installer's unpacking library, or a sign of a risky download?

What unarc.dll does

FreeArc compresses data very tightly, and unarc.dll is the part of it that only unpacks. FreeArc's source code includes an example script that shows an Inno Setup installer how to call the library: the installer carries unarc.dll inside its own .exe, extracts it to a temporary folder, hands it the archive and the target folder, and receives progress and error codes back. When the install ends, the temporary folder and the DLL are removed.

Because it makes large games much smaller to download, the same technique became the standard for repacked game installers, which recompress a game far beyond what its publisher shipped. That is why unarc.dll is so strongly linked to cracked games and why security programs flag the name often. The library does the same job in either case. What changes is the installer around it: a repack comes from an unknown third party, its contents may be modified, and such downloads are a common way to deliver malware.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of unarc.dll

A library never shows in Task Manager under its own name, and this one usually carries no publisher details. Four questions decide it: where the file is, what came with it, whether anything starts it, and whether a scan finds something in the download.

1. List every copy and where it sits. A copy in an is-....tmp folder under Temp while a setup runs, or in a program folder you installed yourself, is expected. Look closer at copies in System32, SysWOW64, AppData, ProgramData or a folder with nothing else in it.

   Get-ChildItem -Path C:\ -Filter unarc.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Find out which download brought it. Look at the folder the copy sits in and the installer that created it. A setup from a publisher or an official store is a normal source. A repacked or cracked game installer is not, and then the whole download is the thing to check, not the DLL.
3. Check that nothing starts it. unarc.dll has no reason to run when Windows starts. Search the startup entries and scheduled tasks for its name. A Run key or task that loads it through rundll32 or a script is a planted copy.

   Get-CimInstance Win32_StartupCommand | Where-Object { $_.Command -match 'unarc' } | Select-Object Name, Command, Location; Get-ScheduledTask | Where-Object { ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'unarc' }

4. Read the version resource and the size. A blank company and description are normal for this library, so they neither clear nor condemn a copy. A copy far larger than a few hundred kilobytes, or one that claims to be a Microsoft file, is not FreeArc's library.

   (Get-Item "C:\path\to\unarc.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion; (Get-Item "C:\path\to\unarc.dll").Length

5. Scan the download folder. Run a Microsoft Defender custom scan on the installer's folder and on the installed game's folder. A detection on the setup .exe or on other files of the game matters more than one on unarc.dll.

A clean unarc.dll says nothing about the rest of a repacked download. The installer, a patched game .exe or an extra program set to start with Windows is where malware from such downloads usually sits.

Do you need unarc.dll?

No installed game or program needs unarc.dll after its setup has finished. A copy left in a program folder you installed from its publisher is harmless and can stay or go. A copy that came with a repacked or cracked game is a reason to remove that game, not only the DLL.

1. Leave a running installer alone. During a setup from a trusted source, the copy in the Temp folder is in use. The installer deletes it at the end; if it stays behind after an aborted install, empty the Temp folder after a restart.
2. Uninstall a game that came as a repack or crack. Open Settings, Apps, Installed apps, find the game and uninstall it. Repacks often have no uninstaller, or leave files behind: then delete the game's whole folder and the installer you downloaded.
3. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds, and look at Protection history for anything found in Downloads, Temp or AppData.
4. Run the offline scan. Some malware bundled with game downloads hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

5. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. Disable and remove entries you do not recognise that run a program from AppData, ProgramData or Temp, and any that mention unarc.dll.
6. Change passwords if you ran an installer you did not trust. Malware bundled with free game downloads is often an information stealer that takes saved browser passwords and session cookies, game store and chat logins included. Change passwords from a clean device and sign out of other sessions.
7. Get the game from its official store. The clean way to play the game is a copy from its official store, where the launcher downloads and checks every file. It also ends the unpacking errors repacked installers are known for.

Warning signs

Known versions of unarc.dll

A public DLL catalogue lists 1 versions of unarc.dll, from 0.0.0.0 to 0.0.0.0, by Unknown. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix unarc.dll errors on uGetFix

Questions people ask