ffmpeg.dll: an Electron app's media library, or a planted copy?

What ffmpeg.dll does

FFmpeg is a widely used open source library for audio and video. Chromium, the engine behind Chrome, builds a cut-down version of it as one file, ffmpeg.dll, holding the decoders and container readers a browser needs. Programs built on Electron or NW.js carry Chromium inside them, and with it their own ffmpeg.dll. Electron publishes a matching ffmpeg build with every release, and the NW.js documentation tells developers they can replace the bundled DLL with their own build to add codecs.

That design is why the file has no fixed identity. Each program's copy comes from its own Chromium release, carries no version or company fields, and may or may not be signed by the program's maker. A file with these traits that is loaded automatically from a program folder at every start is also an attractive target: whoever controls that file runs code inside a trusted, signed program.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of ffmpeg.dll

Four questions decide it: where the file is, what sits next to it, which program it belongs to, and whether that program is current. The version fields are empty on genuine copies, so they do not help, and a library never shows in Task Manager under its own name.

1. List every copy and where it sits. Copies in the folders of programs you installed, such as AppData\Local\Discord, Microsoft VS Code or the EdgeWebView folder, are normal. Look closer at copies in Downloads, Desktop, Temp, C:\Users\Public or a folder you do not recognise.

   Get-ChildItem -Path C:\ -Filter ffmpeg.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Look at what sits next to it. A genuine copy lives among the files of a Chromium build: the program's .exe, libEGL.dll, libGLESv2.dll, .pak files and a locales folder. An ffmpeg.dll beside a single unknown .exe and nothing else matches the way planted libraries are side-loaded by a trusted program.
3. Compare the signature with the program's .exe. Run the command on the DLL and on the .exe in the same folder. When the maker signs its files, both should show Valid and the same signer. A NotSigned DLL is not proof of a fake, because not every maker signs it, but HashMismatch means the file was changed after signing.

   Get-ChildItem "C:\path\to\folder" -Include ffmpeg.dll,*.exe -Recurse | Get-AuthenticodeSignature | Format-Table Path, Status, SignerCertificate -AutoSize

4. Check that the program is wanted and up to date. Find the program in Settings, Apps, Installed apps. If you never installed it, or it is an old build of an app whose maker has issued a security notice, as 3CX did, the copy needs replacing through the maker's fixed version, not just a scan.
5. Compare the size and checksum. Use the file check on this page. The 6 copies in the catalogue range from about 2 MB to 12 MB. A match means the file was seen before in some program; no match is not proof of a fake, because each Electron and NW.js release builds its own copy.

These checks tell you whether the file fits the folder it is in. They cannot tell you whether the program's maker shipped a clean file, as the 3CX case showed. For that, the maker's security notices and an updated build decide.

Do you need ffmpeg.dll?

Keep every copy inside the programs you use: without it the program stops at start-up or plays no media. A copy that failed the checks above belongs to something you did not choose, and the safe way out is to remove that whole program, not only the DLL.

1. Leave the copies of your programs alone. An ffmpeg.dll in the folder of Discord, Teams, VS Code or the WebView2 runtime belongs there. Deleting it only breaks that program, and the program's installer would put it back.
2. Uninstall a program you do not recognise. Open Settings, Apps, Installed apps, find the program the folder belongs to and uninstall it. If there is no uninstaller, as with copies dropped by a download bundle, delete the whole folder, not only ffmpeg.dll.
3. Replace an affected program with the maker's fixed version. For a program named in a security notice, follow the maker's instructions: uninstall the affected build and install the version the notice names, or move to the replacement it recommends.
4. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp, AppData or Public.
5. Run the offline scan. Some malware hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

6. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. After the scan, disable and remove entries that run a program from AppData, ProgramData, Temp or Public that you do not recognise.

Warning signs

Documented abuse

One case is documented by a government security agency. It shows the risk is not a fake program, but a real program whose library was changed before it reached users.

A copy in the right folder, from a real program, is not automatically clean. Keep Chromium-based apps updated and follow their makers' security notices.

Known versions of ffmpeg.dll

A public DLL catalogue lists 6 versions of ffmpeg.dll, from 0.0.0.0 to 0.0.0.0, by Unknown. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix ffmpeg.dll errors on uGetFix

Questions people ask