d3d9.dll is a dubious file despite what anti-virus scans say

Post » Mon Nov 08, 2010 12:49 pm

I'm extremely suspicious of this file. Claims are being made that it's just an earlier version of a DirectX 9 dll but all genuine Microsoft DirectX dll files are digitally signed by Microsoft.

Right click on any genuine Microsoft DirectX dll file and then click on the Details tab and you will find that narly all the Description fields contain information in the Value fields. The Product Name field for example would contain Microsoft DirectX for Windows, while the Copyright field would contain Copyright Microsoft Corp 1994-2007. Any digitally signed files will also have an extra tab labelled Digital Signature.

Now right click on this d3d9.dll file that people are downloading to fix their problems and click on Details and you'll find most of the fields are blank apart from Type, Size and Date Modified and it has no tab for Digital Signature. This tells me it's not a genuine Microsoft file.

This dubious d3d9.dll file also has an alarmingly small file size at 104kb. I'm fairly certain that earlier d3d9.dll files came in at over 1Mb.

Now hopefully this file may well be a custom-written hack by a helpful programmer who has discovered a way to fix performance issues, but there appears very little explanation from the author on exactly what this file does, how it does it and why he wrote it in the first place. Regardless of whether this is a safe file or malicious, what it most certainly isn't is a genuine, digitally signed, earlier version of a DirectX file from Microsoft.

With that in mind you are using it at your own risk.
User avatar
Chris Jones
 
Posts: 3435
Joined: Wed May 09, 2007 3:11 am

Post » Mon Nov 08, 2010 11:09 pm

I'm extremely suspicious of this file. Claims are being made that it's just an earlier version of a DirectX 9 dll but all genuine Microsoft DirectX dll files are digitally signed by Microsoft.

Right click on any genuine Microsoft DirectX dll file and then click on the Details tab and you will find that narly all the Description fields contain information in the Value fields. The Product Name field for example would contain Microsoft DirectX for Windows, while the Copyright field would contain Copyright Microsoft Corp 1994-2007.

This dubious d3d9.dll file also has an alarmingly small file size at 104kb. I'm fairly certain that earlier d3d9.dll files came in at over 1Mb.

Now hopefully this file may well be a custom-written hack by a helpful programmer who has discovered a way to fix performance issues, but there appears very little explanation from the author on exactly what this file does, how it does it and why he wrote it in the first place. Regardless of whether this is a safe file or malicious, what it most certainly isn't is a genuine, digitally signed, earlier version of a DirectX file from Microsoft.

With that in mind you are using it at your own risk.


Yes this file is suspicious.
Yes it is not digitally signed, but that is because whoever uploaded/made it modified the original in some way. Which invalidates the signature. It's probably a fairly blank DirectX .dll that someone compiled with a few lines of code in it. Which is why it is so small. This doesn't mean it is dangerous though. But it also doesn't mean that it isn't dangerous either. :nuke:
User avatar
Rob
 
Posts: 3448
Joined: Fri Jul 13, 2007 12:26 am

Post » Tue Nov 09, 2010 2:58 am

This is exactly why i didn't get the internet version which was being linked around, but rather copied my own.
The difference in size was indeed around 1mb.
User avatar
Javier Borjas
 
Posts: 3392
Joined: Tue Nov 13, 2007 6:34 pm

Post » Mon Nov 08, 2010 11:13 am

My own is dated 4-11-08 (WindowsXP), is 1,650 K, and is only one of many other d3D files with that date.
User avatar
Stryke Force
 
Posts: 3393
Joined: Fri Oct 05, 2007 6:20 am

Post » Mon Nov 08, 2010 9:14 pm

This is exactly why i didn't get the internet version which was being linked around, but rather copied my own.
The difference in size was indeed around 1mb.


I located one on my own system too but sadly it does nothing to improve FPS when I place it in the Fallout New Vegas folder. A performance patch is certainly needed. I don't see this kind of poor performance in Fallout 3. Then again Obsidian has been known to reduce the frame rate of other 3rd party game engines they got their hands on. Just look at how bad Neverwinter Nights 2 was before several patches fixed the low FPS issues ;)
User avatar
Solène We
 
Posts: 3470
Joined: Tue Mar 27, 2007 7:04 am

Post » Tue Nov 09, 2010 3:14 am

D3d9.dll(dx9) is ~450k, Dx9a ~ 600k, DX9b ~800k, Dx9c ~1.7mb(and includes updated code from previous dx9 releases).
User avatar
Liv Brown
 
Posts: 3358
Joined: Wed Jan 31, 2007 11:44 pm

Post » Tue Nov 09, 2010 12:39 am

I located one on my own system too but sadly it does nothing to improve FPS when I place it in the Fallout New Vegas folder. A performance patch is certainly needed. I don't see this kind of poor performance in Fallout 3. Then again Obsidian has been known to reduce the frame rate of other 3rd party game engines they got their hands on. Just look at how bad Neverwinter Nights 2 was before several patches fixed the low FPS issues ;)

It didn't do a whole lot for me either. Prior to trying it my game slowed down massively when engaged in conversation with NPCs and adding the d3d helped on this. But it didn't do anything at all for crowded areas.
User avatar
Stephanie I
 
Posts: 3357
Joined: Thu Apr 05, 2007 3:28 pm

Post » Mon Nov 08, 2010 5:05 pm

The linked one is a wrapper, hence the small size. While I understand the hesitation. unless you want to wait to play for a patch (dont hold your breath, the flashing sky was never fixed in Fallout 3) your stuck with a buggy game.

If you cant find a workable copy on your computer then it may help to search around online for a source you trust.

It would be nice to have a link to the original source of that .dll. It's probably a fan made fix for some other game, usually those can be found with source and a good explication of how they work.
User avatar
Rowena
 
Posts: 3471
Joined: Sun Nov 05, 2006 11:40 am

Post » Mon Nov 08, 2010 4:30 pm

My understanding is that adding the d3d9.dll file already on your system to your NV folder will not do anything.

The purpose of the downloadable d3d9.dll file is to trick the game into thinking you have a directx 9 card and thus uses dx9 to run the game. Feel free to correct me if I am wrong.
User avatar
Damien Mulvenna
 
Posts: 3498
Joined: Wed Jun 27, 2007 3:33 pm

Post » Tue Nov 09, 2010 2:34 am

I located one on my own system too but sadly it does nothing to improve FPS when I place it in the Fallout New Vegas folder :(


That's because Fallout already uses that one and placing it in your game folder will not change how it runs. It has been stated that the D3D9.dll that is floating around is basically a hack that causes the part of the code causing the problem not to be run for whatever reason.

I felt the same way you do about the file when I first discovered it for Fallout 3. I ran it in a virtual sandbox to limit the damage it may have inflicted as well as monitor the connections to my machine while is was running. I saw no issues and started running Fallout 3 in the main OS and have been for almost a year. This was the only way I could get Fallout 3 to work and now it seems it is the only way I can get Fallout New Vegas to run.

I have tried all kinds of drivers latest and older versions, installed latest bios for MoBo, firmware for all my hardware and even tried it on a fresh install of Windows 7 Ultimate and it always crashes at the same point. Just after the opening cinemas. The file from megafiles that is linked from the video on Youtube has allowed me to play the game. Maybe not how Bethesda originally intended it to be seen but the way they presented it I could not even see it at all.

I would really love it if they would fix this but to be honest after almost a year I have my doubts it will be.
User avatar
Penny Flame
 
Posts: 3336
Joined: Sat Aug 12, 2006 1:53 am

Post » Tue Nov 09, 2010 1:56 am

That's because Fallout already uses that one and placing it in your game folder will not change how it runs. It has been stated that the D3D9.dll that is floating around is basically a hack that causes the part of the code causing the problem not to be run for whatever reason.

I felt the same way you do about the file when I first discovered it for Fallout 3. I ran it in a virtual sandbox to limit the damage it may have inflicted as well as monitor the connections to my machine while is was running. I saw no issues and started running Fallout 3 in the main OS and have been for almost a year. This was the only way I could get Fallout 3 to work and now it seems it is the only way I can get Fallout New Vegas to run.

I have tried all kinds of drivers latest and older versions, installed latest bios for MoBo, firmware for all my hardware and even tried it on a fresh install of Windows 7 Ultimate and it always crashes at the same point. Just after the opening cinemas. The file from megafiles that is linked from the video on Youtube has allowed me to play the game. Maybe not how Bethesda originally intended it to be seen but the way they presented it I could not even see it at all.

I would really love it if they would fix this but to be honest after almost a year I have my doubts it will be.


If you used it for Fallout 3 I dont suppose you know where it originated from? My guess it's a wrapper that imports the official d3d9's functions (from the copy already installed in C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7600.16385_none_c223c2c8c219cb6a) and overwrites or changes the offending function.
This is a common thing for getting older games to work. (There is a number of them for X-COM UFO) It's not much different the the Fallout Script Enhancer that wraps around the fallout3.exe and adds functionality.
User avatar
Matthew Barrows
 
Posts: 3388
Joined: Thu Jun 28, 2007 11:24 pm

Post » Mon Nov 08, 2010 6:14 pm

If you used it for Fallout 3 I dont suppose you know where it originated from? My guess it's a wrapper that imports the official d3d9's functions (from the copy already installed in C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7600.16385_none_c223c2c8c219cb6a) and overwrites or changes the offending function.
This is a common thing for getting older games to work. (There is a number of them for X-COM UFO) It's not much different the the Fallout Script Enhancer that wraps around the fallout3.exe and adds functionality.

That's probably what it is. That DLL does a lot, so the smaller version is most likely not a replacement. The game loads the hacked DLL, and the hacked DLL loads the real one installed on your system, relaying calls it doesn't need to modify directly to classes in the "real" DLL that is installed on your system and actually replacing others.

The author is obviously not going to have access to Microsoft's root certificate to create a real signature for the file, so I wouldn't expect something like this to be signed by Microsoft...that doesn't mean it's dangerous. Using any 3rd-party .exe or .dll is giving it access to your system to some extent, though, so there is some small amount of risk involved. I'm personally not too worried about this one, though.
User avatar
Rob Davidson
 
Posts: 3422
Joined: Thu Aug 02, 2007 2:52 am

Post » Mon Nov 08, 2010 3:27 pm

If you used it for Fallout 3 I dont suppose you know where it originated from?



Originally found this http://www.youtube.com/watch?v=c47UXdfWA7s a later version was released http://www.youtube.com/watch?v=4GN5HbMsMVE that explains the proceedure for people a little better.
User avatar
Cassie Boyle
 
Posts: 3468
Joined: Sun Nov 05, 2006 9:33 am

Post » Mon Nov 08, 2010 9:14 pm

Ok, i set asside my paranoia and used the downloaded d3d.

AND IT WORKS!!!

Ultra settings, everything on absolute max and not a single stutter nor NPC slowdown.

I just had a scenario where 20'ish people were fighting, and not a single drop.

Frames capped at 60 and never dropping lower than this. Smooth as a baby's but!
User avatar
brian adkins
 
Posts: 3452
Joined: Mon Oct 01, 2007 8:51 am

Post » Mon Nov 08, 2010 2:13 pm

I just had a scenario where 20'ish people were fighting, and not a single drop.

Frames capped at 60 and never dropping lower than this. Smooth as a baby's but!

But what?


Sorry, I had to... :shifty:
User avatar
Joanne
 
Posts: 3357
Joined: Fri Oct 27, 2006 1:25 pm

Post » Mon Nov 08, 2010 2:42 pm

If you used it for Fallout 3 I dont suppose you know where it originated from?

Ask and ye shall receive, here is the original post from its author: http://www.oldblivion.com/sm/index.php?topic=5831.msg76421#msg76421

I hate to be "that guy," but there are already at least http://www.gamesas.com/index.php?/topic/1123460-potential-fix-for-npc-slowdown/ http://www.gamesas.com/index.php?/topic/1123822-potential-fix-for-npc-slowdown/ discussing whether or not this file is a virus/trojan/malware/other (it isn't) and if it is a working fix for numerous people (it is, including myself and I'm as paranoid as they come). Using the forum search functionality would have turned these discussions up, along with others. :)

It's not an official DLL from Microsoft; it's a wrapper that was written by a fan to specifically work around limitations in the game engine. More than 27,000 people have already downloaded this from New Vegas Nexus, a known good mod site, and I'm relatively sure that if it infected that many people with something, it would have been pulled. Here's a link to the file hosted there for your convenience: http://newvegasnexus.com/downloads/file.php?id=34778

Don't get me wrong, extreme caution about downloading random files off the Internet because some random person told you to is absolutely a good thing. If you're still not convinced that the file is harmless, by all means, don't download it. We're all hoping that there's an official fix for this soon.

Edit: fixed broken links
User avatar
c.o.s.m.o
 
Posts: 3419
Joined: Sat Aug 12, 2006 9:21 am

Post » Mon Nov 08, 2010 6:03 pm

See the original post. This file has been explained.
User avatar
Rachel Briere
 
Posts: 3438
Joined: Thu Dec 28, 2006 9:09 am

Post » Tue Nov 09, 2010 3:50 am

I had to replace the default atimgudpl.dll library with a 64 bit version ( downloaded at mydll ) to play Fallout 3 .

I was getting poor performance, HDR flickering, and weird water reflections until I replaced that dll.

And all I know the most recent dll has improved performance for FO:NV.

Norton 2011 says it's clean..

If it was something nasty. somebody would have said something by now..you can bet on that.

Installing / replacing dlls to get a game to work is nothing new. It shouldn't have happened in the first place though.

The only problems I have now are save games and a weird wire frame ( humans only ) on vats.
User avatar
Rachael
 
Posts: 3412
Joined: Sat Feb 17, 2007 2:10 pm

Post » Mon Nov 08, 2010 10:45 pm

Ask and ye shall receive, here is the original post from its author: http://http://www.oldblivion.com/sm/index.php?topic=5831.msg76421#msg76421


Not sure if that's the same person or dll but the Youtube video I posted was dated 6 months before the post in that thread.
User avatar
Crystal Clarke
 
Posts: 3410
Joined: Mon Dec 11, 2006 5:55 am

Post » Mon Nov 08, 2010 11:06 pm

AFAIK the original purpose of this file was to trick the FO3 launcher into running on Intel integrated graphics cards, otherwise it would refuse to run. I really don't know what it is or how it works, some people say it's a DX9 XP file, some says it's a modded wrapper for DX9 games on DX10/DX11, some have even said that DX9 games runs through an emulation layer on DX10/DX11 and this tricks it to run natively. Not sure which is true, if anything at all, but I can assure you that it works great. I took screenshots and nothing is graphically lost at all. What is a fact is it tricks the game into thinking your graphics card is an nvidia 7900gs, but this doesn't prevent you from maxing it out. It does prevent framerate issues that occur when NPC talk or when several are on the screen.

Originally when pointed out, the download was from megaupload and contained confusing banner ads that launched rootkits (and somebody from bethesda stepped in to warn us about 3rd party downloads). The FO3 nexus links are rootkit-free and the only reason this file isn't signed or includes any info from MS is because somebody modded it to be 7900gs-specific as mentioned above. It's clean, it works, it doesn't overwrite anything, and so far there is no alternative from either Bethesda/Obsidian, nVidia, AMD, MS, or Valve (not that it's a valve/steam problem anyways).
User avatar
NeverStopThe
 
Posts: 3405
Joined: Tue Mar 27, 2007 11:25 pm

Post » Tue Nov 09, 2010 12:11 am

AFAIK the original purpose of this file was to trick the FO3 launcher into running on Intel integrated graphics cards, otherwise it would refuse to run. I really don't know what it is or how it works, some people say it's a DX9 XP file, some says it's a modded wrapper for DX9 games on DX10/DX11, some have even said that DX9 games runs through an emulation layer on DX10/DX11 and this tricks it to run natively. Not sure which is true, if anything at all, but I can assure you that it works great. I took screenshots and nothing is graphically lost at all. What is a fact is it tricks the game into thinking your graphics card is an nvidia 7900gs, but this doesn't prevent you from maxing it out. It does prevent framerate issues that occur when NPC talk or when several are on the screen.

Originally when pointed out, the download was from megaupload and contained confusing banner ads that launched rootkits (and somebody from bethesda stepped in to warn us about 3rd party downloads). The FO3 nexus links are rootkit-free and the only reason this file isn't signed or includes any info from MS is because somebody modded it to be 7900gs-specific as mentioned above. It's clean, it works, it doesn't overwrite anything, and so far there is no alternative from either Bethesda/Obsidian, nVidia, AMD, MS, or Valve (not that it's a valve/steam problem anyways).


Amazingly well put my good man!
User avatar
yessenia hermosillo
 
Posts: 3545
Joined: Sat Aug 18, 2007 1:31 pm

Post » Mon Nov 08, 2010 1:01 pm

I loaded the DLL into a dissassembler and looked through the code and it seems to contain nothing suspicious. You can usually search through a file's string table, looking for dodgy web addresses that many malicious files contain to send information to the hackers website, but thankkfully there are none. The string table also shows an entry for a GeForce 7900 video card so I suspect this is what is forcing Fallout to enumerate the installed video card to this specific model?

I'm amazed this problem hasn't been addressed either by Nvidia at the driver level, or by the developers at the game client level by providing a more elegant way to force DirectX 9, like from the Steam command line facility?
User avatar
Ellie English
 
Posts: 3457
Joined: Tue Jul 11, 2006 4:47 pm


Return to Fallout: New Vegas