xlive.dll: Microsoft's Games for Windows - LIVE library, a crack's replacement, or malware?

What xlive.dll does

xlive.dll is the library behind Games for Windows - LIVE, the Microsoft service that linked PC games to an Xbox profile for sign-in, achievements, friends, profile-bound saves and online play. Publishers shipped the runtime with their games, and the game's setup, or the store that sells the game, runs the redistributable. That package installs one shared copy of the 32-bit library into the system folder, and on 64-bit Windows the file system redirector sends 32-bit programs to SysWOW64 for it.

The library also handles the sign-in that a GFWL game expects before it lets you play or save. That is the part a crack has to remove, and the simple way is to drop a modified xlive.dll into the game folder: Windows searches the program's own folder before the system folders, so the game loads that file instead of Microsoft's. Such a file is not necessarily malware in itself, but it is not Microsoft's, and the download that brought it decides whether the PC is safe.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of xlive.dll

Four questions decide it: where the file is, what it says about itself, who signed it, and what sits next to it. A library never shows in Task Manager under its own name, so use these checks.

1. List every copy and where it sits. One copy in C:\Windows\SysWOW64 (64-bit Windows) or C:\Windows\System32 (32-bit Windows) is the runtime. Look closer at any copy in a game folder, Downloads, Desktop, Temp or AppData.

   Get-ChildItem -Path C:\ -Filter xlive.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Read the version resource. Microsoft's file reports Microsoft Corporation as the company and Games for Windows - LIVE DLL as the description. A replacement often leaves these fields empty or different, though a careful one copies them, so this check alone does not clear a file.

   (Get-Item "C:\path\to\xlive.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

3. Check the digital signature. Status Valid with a Microsoft signer means an unmodified Microsoft build. NotSigned, HashMismatch or another signer means the file is not Microsoft's as shipped. Text fields can be copied; a valid signature cannot.

   Get-AuthenticodeSignature "C:\path\to\xlive.dll" | Format-List Status, SignerCertificate

4. Look at what sits next to it. A replacement in a game folder usually comes with its own configuration, such as a .ini file with a similar name, or with the game's original files renamed. Any copy in a game folder means the folder was modified, whatever the file says about itself.
5. Compare the size and checksum. Use the file check on uGetFix. Microsoft's builds in the catalogue weigh about 7 MB to 15 MB, so a much smaller xlive.dll is not one of them. A match identifies a known Microsoft copy; no match is not proof of a fake. The signature check above is the deciding one.

A valid Microsoft signature clears that one file. It says nothing about the .exe, installer or other files that came with a cracked game, which is where malware from such downloads is usually found.

Do you need xlive.dll?

Keep the copy in the system folder as long as you play games that use Games for Windows - LIVE: without it they do not start. A copy that failed the checks above came with a game you got elsewhere, and the safe way out is to remove that game, not only the DLL.

1. Leave the system copy alone while you play GFWL games. Every game that uses the service shares the copy in SysWOW64 or System32. If you no longer play any of them, uninstall Microsoft Games for Windows - LIVE Redistributable and Microsoft Games for Windows Marketplace in Settings, Apps, Installed apps, instead of deleting the file by hand.
2. Uninstall a game that did not come from its publisher or a store. Open Settings, Apps, Installed apps, find the game and uninstall it. Repacks and free downloads often have no uninstaller: then delete the game's whole folder, not only xlive.dll.
3. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp or AppData.
4. Run the offline scan. Some malware bundled with game downloads hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

5. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. Disable and remove entries that run a program from AppData, ProgramData or Temp that you do not recognise, after the scan.
6. Change passwords if the download ran an installer you did not trust. Malware bundled with free game downloads is often an information stealer that takes saved browser passwords and session cookies, game store and chat logins included. Change passwords from a clean device and sign out of other sessions.

Warning signs

Known versions of xlive.dll

A public DLL catalogue lists 9 versions of xlive.dll, from 1.0.6027.0 to 3.5.92.0, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix xlive.dll errors on uGetFix

Questions people ask