user32.dll: genuine Windows file, or a fake copy outside System32?

What user32.dll does, and why malware uses it without replacing it

user32.dll holds the USER part of the Windows API. A program calls it to create its windows, menus, buttons and dialog boxes, to move and redraw them, to use the clipboard and timers, and to receive messages: every key press, mouse movement and click reaches a program as a message delivered through user32.dll. Much of the real work is done in the Windows kernel, and user32.dll passes those calls on through win32u.dll. A program without a window can run without it, but File Explorer, browsers, games and almost every desktop app load it.

Windows treats user32.dll as a known DLL. Its name is listed in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs, and for every DLL on that list Windows uses its own copy instead of searching the program's folder. That is the difference from files such as dinput8.dll, which tools replace with a proxy in a game folder. A user32.dll dropped next to an .exe is not loaded from there.

Malware therefore does not need a fake user32.dll. It uses the genuine one, as every program does. Keyloggers call functions such as SetWindowsHookEx, GetAsyncKeyState and GetForegroundWindow to record what you type and in which window, and SetWindowsHookEx can also make Windows load a DLL into other programs. The same functions serve hotkey tools, screen readers and macro software, so seeing user32.dll in a process or a crash report says nothing about infection.

One more legitimate use looks suspicious at first sight: lock shortcuts and scripts often run rundll32.exe user32.dll,LockWorkStation to lock the PC. Where a file named user32.dll does matter is outside the Windows folders. Malware authors give their files the names of system files so that a quick look in a folder does not stand out. Such a file is not Windows' library, whatever its name, and only its folder, signature and hash show what it is.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell the genuine user32.dll from a copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies, and copies inside C:\Windows\WinSxS belong to Windows updates. Every other path deserves a closer look.

   Get-ChildItem C:\ -Recurse -Filter user32.dll -ErrorAction SilentlyContinue | Where-Object FullName -notlike 'C:\Windows\WinSxS\*' | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the version. Right-click the file, Properties, Details. The genuine file says Multi-User Windows USER API Client DLL, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100 or 10.0.19041. A copy can imitate these fields, so this check only rules files out.
3. The digital signature. The genuine copies are signed by Microsoft, often through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer means the file is not Microsoft's.

   Get-AuthenticodeSignature 'C:\path\to\user32.dll' | Format-List Status, SignatureType, SignerCertificate

4. Which copy processes really load. Open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type user32.dll and press Search. Every process should show C:\Windows\System32\user32.dll, or C:\Windows\SysWOW64\user32.dll for 32-bit programs. A loaded user32.dll from any other path is a serious warning sign.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with 1,085 known Microsoft builds. A copy outside the Windows folders that matches is a genuine file someone copied there; one that does not match is not Microsoft's file.
6. Look at what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler, and look for entries that run rundll32.exe with a user32.dll path. rundll32.exe user32.dll,LockWorkStation is a normal lock command; a path outside System32 or another function name deserves a scan.

A match to a Microsoft build proves the file is Microsoft's, but not that it belongs where you found it: a genuine user32.dll in Downloads is still a stray copy. A copy that matches nothing and sits outside the Windows folders is not a Windows file, whatever it is called. The genuine copies cannot tell you whether a keylogger is running, because every program with a window loads them.

Warning signs and what they mean

Everyday problems with user32.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

user32.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 1085 Microsoft builds in total are known.

Questions people ask