mfc140.dll: how to tell Microsoft's MFC library from a copy that does not belong

What mfc140.dll does

Microsoft Foundation Classes is a C++ framework that turns the raw Windows interface into ready parts: main windows, dialog boxes, buttons and lists, documents with views, printing. A program built with MFC either carries that code inside its .exe or loads it from a DLL. mfc140.dll is the shared DLL for programs compiled with the multibyte (ANSI) character set. Microsoft's naming table for MFC gives MFCversion.DLL as the ANSI or MBCS release build and MFCversionU.DLL as the Unicode one, so mfc140u.dll is its Unicode twin.

The 140 stands for MFC version 14, shared by Visual Studio 2015 through 2022. Each genuine build exports more than 9,200 functions and imports only Windows libraries plus vcruntime140.dll. Because programs search their own folder first, installers often put mfc140.dll next to the .exe, which explains copies in Program Files. The same search order is also why a file with this name in an odd folder deserves a second look.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of mfc140.dll

Where the copy sits, how large it is and who signed it answer the question for almost every case. A DLL never appears in Task Manager under its own name, so these checks replace it.

1. Find every copy on the system drive. Paste this into PowerShell. Copies under C:\Windows and C:\Program Files are expected. Write down any copy in Downloads, Temp, AppData, ProgramData or C:\Users\Public and run the next checks on it.

   Get-ChildItem -Path C:\ -Filter mfc140.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Verify the digital signature. A genuine copy returns Status Valid, with Microsoft Windows Software Compatibility Publisher or Microsoft Corporation as the signer. NotSigned, or any other company, means the file is not Microsoft's MFC. HashMismatch means a Microsoft file that someone modified after it was signed.

   Get-AuthenticodeSignature "C:\path\to\mfc140.dll" | Format-List Status, SignerCertificate

3. Check that the size makes sense. Genuine builds are several megabytes: the current one is 5,563,320 bytes for x64 and 4,855,744 bytes for x86, and the older builds people have on their PCs fall in the same range. A file of a few hundred kilobytes or less with this name is not MFC. The file check on this page compares the SHA-256 checksum with the builds we know.
4. See which process loaded it. In Process Explorer (Microsoft Sysinternals) choose Find, Find Handle or DLL and enter mfc140.dll. Each hit shows the process and the exact path of the copy it loaded. A design, engineering or hardware tool you use, loading a copy from its own Program Files folder, is normal. An unfamiliar process running from a user folder is not.
5. Look at the company it keeps. Open the folder of a suspicious copy. A program folder normally holds the program's .exe, its own DLLs and data files with readable names. A short-lived folder in Temp that one installer creates and removes is harmless too. A folder that stays, with one signed .exe, mfc140.dll and a file with a meaningless name or extension, is the layout side-loading uses.

A valid Microsoft signature shows that mfc140.dll itself is genuine. It does not vouch for the program that loaded it or for other files in the same folder.

Do you need mfc140.dll?

Yes, if any program on the PC uses the ANSI MFC library: without the file it stops at startup. Keep the signed copies in the Windows folders and in program folders, and remove a copy only together with the program it belongs to.

1. Keep System32 and SysWOW64 as they are. Those copies come from the redistributable and are shared by every MFC program. Deleting them breaks programs and protects you from nothing.
2. Remove an unwanted program the normal way. If a private copy belongs to a program you no longer use, open Settings, Apps, Installed apps, select the program and choose Uninstall. Its own mfc140.dll leaves with it.
3. Set aside a copy you cannot explain. For a copy that failed the signature check, or sits beside an unknown .exe in a user folder, move that whole folder into a new folder you create for quarantine, rather than deleting it at once. You can restore it if a program you need stops working.
4. Run a Microsoft Defender full scan. In Windows Security choose Virus and threat protection, Scan options, Full scan. Let Defender quarantine what it finds before you remove anything by hand.
5. Add an offline scan for an unsigned copy. The offline scan restarts the PC and runs before Windows loads, so code running inside another program cannot hide from it. Expect about 15 minutes.

   Start-MpWDOScan

6. Clear what would start it again. Check Settings, Apps, Startup and Task Scheduler for entries that run a program from the folder where the suspicious copy was, and delete those entries after the scan.

Warning signs

Known versions of mfc140.dll

A public DLL catalogue lists 10 versions of mfc140.dll, from 14.0.23026.0 to 14.25.28508.3, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix mfc140.dll errors on uGetFix

Questions people ask