version.dll: genuine Windows file, or a copy planted next to a program?

What version.dll does, and why programs load other copies of it

version.dll holds the Windows functions that read the version resource of a file: GetFileVersionInfo, GetFileVersionInfoSize, VerQueryValue and a few more. Installers use them to decide whether a file on the PC is older or newer than the one they carry, and programs use them to show their own version or to check another file's. Windows ships the library in every release and updates it together with Windows.

Because so many programs load version.dll at start, and because it is not on the short list of libraries Windows always takes from System32, a program looks for it in its own folder first. A tool author builds a library with the same name and the same exported functions, puts it next to the .exe, and the program loads it. The copy forwards the real calls to the Windows file, so the program works normally, and in the same moment runs the tool's own code inside it.

Mod loaders, plugin loaders, frame rate and resolution patches and overlays use this on purpose. Attackers use the same technique, called DLL side-loading: they ship a legitimate, signed program together with a malicious version.dll in one folder, so their code runs inside a process that looks trusted. HijackLibs, a public list of DLL hijacking cases, names 42 programs that load version.dll this way, among them 37 Windows programs such as certutil.exe, mstsc.exe and msconfig.exe when they are copied out of System32.

So the question is never whether version.dll is a virus, but which version.dll you are looking at. The copies in the Windows folders are Microsoft's. A copy next to a program is whatever the person who made it put into it.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a version.dll in a program folder from Windows' copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32, C:\Windows\SysWOW64, C:\Windows\System32\forwarders and the WinSxS store are Windows' copies. Every other path is a copy that something installed. If you did not install a mod or patch for that program, find out what did.

   Get-ChildItem C:\ -Recurse -Filter version.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. What sits next to it. Look at the .exe files in the same folder. A Windows program such as certutil.exe, mstsc.exe or msconfig.exe outside C:\Windows, next to a version.dll, is a classic side-loading pair. So is a signed program from another company in Temp, AppData or Downloads with an unsigned version.dll beside it.
3. The Description field and the size. Right-click the file, Properties, Details. The genuine file says Version Checking and File Installation Libraries, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. A tool's copy usually shows another description and a size that matches no Windows release in the facts table. These fields can be copied, so this check only rules files out.
4. The digital signature. Windows' copy is signed by Microsoft through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer on a program folder copy means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\program\version.dll' | Format-List Status, SignatureType, SignerCertificate

5. What the program loads. Start the program, then open Process Explorer from Microsoft Sysinternals, choose Find, Find Handle or DLL, type version.dll and press Search. The path column shows which copy each process really loaded. A path outside the Windows folders means the copy is running inside that process.
6. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A program folder copy that matches is an unneeded Windows copy; one that does not match is a third-party file.

A match to a Microsoft build proves the file is Microsoft's. A file that does not match is not automatically malicious: many program folder copies are mod loaders that do exactly what their authors say. What decides is whether you chose to install that tool, from where, and whether the file is the one its author published.

Warning signs and what they mean

How attackers have used the name version.dll

Published research names malicious version.dll files. In these cases the genuine Microsoft file was not involved: the attackers shipped their own DLL under this name for a legitimate program to load.

MITRE ATT&CK lists this as Hijack Execution Flow: DLL Side-Loading (T1574.002). The useful test on a home PC is the folder and the signer, not the name: a malicious version.dll keeps the genuine file name, and the program that loads it is often genuine and signed.

Programs that have been made to load a fake version.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted version.dll. Usually the attacker copies the program into another folder and puts a fake version.dll next to it: Windows looks in the program's own folder first. A version.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine version.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine version.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

and 32 more programs. Source: the HijackLibs entry for version.dll, 10 public reports.

Everyday problems with version.dll

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

version.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 341 Microsoft builds in total are known.

Known versions of version.dll

A public DLL catalogue lists 16 versions of version.dll, from 5.1.2600.2180 to 10.0.18362.1, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix version.dll errors on uGetFix

Questions people ask