A malicious threat was detected in Media Player Classic exe file

When I run HitmanPro, it says that mpchc64.exe is a trojan. A virustotal analysis seems to show malicious flags triggered by several vendors.

enter image description here What is going on? Why does a file by Media Player Classic team contain a trojan?


That is not the version of Media Player Classic installed on your computer, and indeed is a virus. Why?

Look at the folder the executable with a virus was found in - a folder which appears to be for temporary or cached files used by Adobe Flash Player. In terms of the actual virus, it appears to be a variant of Win32/BitCoinMiner.G, which is indeed a real virus (using your computer power to mine bitcoins).

Lastly, you should be aware that the Product/Publisher/Descriptions contained in a .EXE file are set when the application is compiled. They are in no way "official" and can easily be spoofed.


If you're wondering how that file got on your computer, it could possibly have been a drive-by download. Make sure all of your antivirus software is up to date, and if you use any third-party addons in your web browser (especially Java or Flash), make sure they are always up to date (or preferably, disabled!).


  1. The real MPC-HC doesn't get installed to Flash's cache folder, unless you somehow decided to place it there.

  2. The real file is called mpc-hc64.exe

  3. The real file is not a mere 129 KB in size (which obviously means it has a completely different SHA-256 hash).

  4. Finally, the real version obviously is not launched on startup by a hidden batch file, as you yourself seem to have discovered.

So what makes you assert that this really is "a file by Media Player Classic team"?