mfplat.dll: genuine Windows Media Foundation file, or a planted copy?

What mfplat.dll does, and how a planted copy gets loaded

mfplat.dll is the platform part of Media Foundation, the audio and video framework of Windows. A program loads it to open media files and streams, hand video to the graphics card for decoding, convert between formats and capture from cameras and microphones. Windows 10 and Windows 11 include it in every full edition. N and KN editions, sold without Windows Media Player and the media technologies, do not have it until the Media Feature Pack from Microsoft is added, which is why this file name shows up in so many missing file errors.

Because mfplat.dll is not one of the libraries Windows always takes from System32, a program that needs it looks in the program's own folder first. HijackLibs, a public list of DLLs that can be used this way, records two Windows programs from System32 that load mfplat.dll: mfpmp.exe, the Media Foundation protected pipeline host, and mdeserver.exe. Copy either one into another folder, put a file named mfplat.dll next to it, and the Microsoft program loads that file instead of the genuine one.

This technique is called DLL side-loading. The attacker's code then runs inside a program that is signed by Microsoft, which helps it pass a quick look in Task Manager and some security rules that trust Microsoft's signature. It runs with the rights of the user who started it and can read files, open network connections and start other programs.

So the useful question is not whether mfplat.dll is a virus, but which mfplat.dll you are looking at. The two copies in the Windows folders are Microsoft's. A copy in a user folder, and above all one sitting next to a copy of a Windows program, is not.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell a planted mfplat.dll from Windows' copy

A DLL is not listed in Task Manager as a process, so use the folder, the file properties, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies, and the WinSxS folder holds stored originals that Windows manages itself. Any other path is a copy that something placed there. If the same folder also holds mfpmp.exe or mdeserver.exe outside System32, treat the pair as a side-loading setup.

   Get-ChildItem C:\ -Recurse -Filter mfplat.dll -ErrorAction SilentlyContinue | Where-Object FullName -notlike 'C:\Windows\WinSxS\*' | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. The Description field and the size. Right-click the file, Properties, Details. The genuine file says Media Foundation Platform DLL, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. Its size matches one of the Windows releases in the facts table, about 2 MB for the 64-bit file. A planted copy can fake these fields, so this check only rules files out.
3. The digital signature. Windows' copy is signed by Microsoft through a catalog rather than inside the file, so the Properties window often shows no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned, HashMismatch or another signer means the file is not Windows' copy.

   Get-AuthenticodeSignature 'C:\path\to\mfplat.dll' | Format-List Status, SignatureType, SignerCertificate

4. What a running program loaded. Open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type mfplat.dll and press Search. The path column shows which copy each program loaded. A path outside System32 and SysWOW64, or an mfpmp.exe or mdeserver.exe running from a user folder, deserves a close look.
5. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds. A copy that matches is Microsoft's file in the wrong place; one that does not match is a third-party file using the name.
6. Scan before you trust or delete. Run Microsoft Defender's full scan, and the offline scan if a detection keeps coming back. Also look at what started the program that loaded the copy: a scheduled task, a Run key in the registry or a shortcut in the Startup folder.

A match to a Microsoft build proves the file is Microsoft's, not that it is in the right place. A file that does not match is not automatically malicious: it can be a build from a Windows update newer than the index. What decides is the folder it sits in, its signature, and whether a copied Windows program sits next to it.

Warning signs and what they mean

Programs that have been made to load a fake mfplat.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted mfplat.dll. Usually the attacker copies the program into another folder and puts a fake mfplat.dll next to it: Windows looks in the program's own folder first. A mfplat.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine mfplat.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine mfplat.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

Source: the HijackLibs entry for mfplat.dll, 1 public report.

Everyday problems with mfplat.dll

mfplat.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 308 Microsoft builds in total are known.

Known versions of mfplat.dll

A public DLL catalogue lists 20 versions of mfplat.dll, from 10.0.14393.0 to 12.0.10586.494, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix mfplat.dll errors on uGetFix

Questions people ask