Manufacturer-signed installer, Microsoft-signed DLLs or executables. Anything else is a virus.