10

These two files appeared in the root of my C: drive in Windows 11. Does anybody know what created them? What is their purpose and why are they in root?

  • appverifUI.dll
  • vfcompat.dll
Dr. Gut
  • 386
  • 3
  • 13
user1733875
  • 101
  • 1
  • 3
  • appverifUI.dll is [Application Verifier](https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/application-verifier) and it’s a legitimate application, vfcompat.DLL likely is connected to it. As for location, it was probably installed to that location, by a user – Ramhound Sep 27 '22 at 05:15
  • 2
    Are there also a bunch of .txt files like readme.txt? Some older MSVC Runtime installers used to accidentally extract their temporary files into C:\ directly and then failed to clean them up after installation. – u1686_grawity Sep 27 '22 at 06:18
  • No, just two dlls. [link](https://pasteboard.co/QKsrXcGLKNqZ.png) – user1733875 Sep 27 '22 at 12:00
  • Are they signed by Microsoft? – Ramhound Sep 27 '22 at 12:44
  • Yes, but file compare says they are different from c:\Windows\System32\appverifUI.dll and c:\Windows\SysWOW64\appverifUI.dll. – user1733875 Sep 27 '22 at 12:51
  • 1
    Today I installed Windows 11 SDK (10.0.22621.0) from Visual Studio Installer v3.4.2246.31370. After that I noticed these two files in C:\. Their sizes are: `appverifUI.dll` = 112,104 bytes, `vfcompat.dll` = 66,176 bytes. Their file version: `appverifUI.dll` = N/A, `vfcompat.dll` = 10.0.22621.755. – Dr. Gut Jan 31 '23 at 17:32
  • I have them too. Same sizes and signed by Microsoft. I have Visual Studio. I'm guessing some component of it has a buggy installer. – Vimes May 13 '23 at 14:30
  • Your question has an answer here: https://stackoverflow.com/a/76300242/8659747 – Kitswas May 27 '23 at 08:44
  • Yesterday I updated Visual Studio to 17.6.4. After that I noticed these two files in C:\. Their sizes are: `appverifUI.dll` = 112,080 bytes, `vfcompat.dll` = 66,160 bytes. Their file version: `appverifUI.dll` = N/A, `vfcompat.dll` = 10.0.22621.1778. I just deleted them the last time (5 months ago), and didn't notice anything wrong. I deleted them now too. – Dr. Gut Jun 21 '23 at 19:25

2 Answers2

0

Does anybody know what created them?

These files appeared for me after running the Windows 11 SDK 10.0.22621.1778 installer.

What is their purpose

From my research in to this, it appears that appverifUI.dll (UI Definition) and vfcompat.dll (required to run the Compatibility tests) are needed by Application Verifier (appver) from Microsoft.

enter image description here

The test can be enabled through the UI (shown above) or through the command line using:

appverif -enable HighVersionLie -for xcopy.exe

Replace xcopy.exe with the executable you need to test.

When the application is launched next, these tests are run. I verified errors in the UI and running Compatibility tests when they are removed. However, removing the DLLs in the C:\ root folder did not affect the operation of C:\system32\appverifUI.exe.

Duplicate DLLs found in C:\windows\system32

Under C:\windows\system32 two DLLs with the same name exist, and this lead me to compare the differences under a DLL viewer tool. I choose JetBrains dotPeek (free), and with a little help from this answer, I noticed these values under the Machine segment of the File (COFF) header:

enter image description here

It becomes clear that one is 32-bit (0x014C = i386) and the other is 64-bit (0x8664 = AMD64) versions of the DLL required by appverif.exe. Surprisingly, I also found appverif.exe in C:\SysWOW64. Then, I found this in the Application Verifier documentation:

Using Application Verifier with WOW64

You can use either the 32-bit or the 64-bit version of Application Verifier to verify a 32-bit application running under WOW64.

Ironically, it looks like the 32-bit appverif.exe is located in C:\Windows\SysWOW64 (also supported here).

Following through on my hunch, I tried to run C:\SysWOW64\appverif.exe and it ran only through command line. However, after moving C:\appverifUI.dll and C:\vfcompat.dll in to C:\Windows\SysWOW64, I was able to launch the UI and run Compatibility tests.

why are they in root

At this I can only speculate - I would guess they are some how linked together elsewhere (i.e. by references in the SDK).

However, one thing is clear, if you need to use the 32-bit appverif UI and run the corresponding Compatibility tests, you should not delete those files. But, I can't see why you would need the 32-bit appverif since the 64-bit version works too.

aqf
  • 67
  • 3
0

I have the same two files in C:/, and they are both 32-bit dlls, and I checked the version of C:/vfcompat.dll (10.0.22621.xxx), C:/Windows/SysWOW64/vfcompat.dll (10.0.22000.xxx) and C:/Windows/SysWOW64/appverif.exe (10.0.22621.xxx).

So I moved the two files to C:/Windows/SysWOW64/.

Donghua Liu
  • 101
  • 1