ExpressFiles

By CagedTech in Potentially Unwanted Programs

Threat Scorecard

Ranking:	4,660
Threat Level:	10 % (Normal)
Infected Computers:	46,534

First Seen:	January 3, 2014
Last Seen:	April 20, 2024
OS(es) Affected:	Windows

ExpressFiles is a Potentially Unwanted Program that may cause a wide variety of problems on affected computers. Potentially Unwanted Programs, usually represented using the acronym PUP, may be used by marketers to profit from advertising schemes and cause significant problems on affected computers. Software like ExpressFiles is marketed and promoted as a useful add-on for the computer user's Web browser commonly. However, in the vast majority of the cases, security researchers have observed that the many unwanted symptoms associated with these PUPs seldom warrants the supposed benefits that can be gained from using them. This happens because the prime function of these programs is to profit from advertising rather than delivering useful services to computer users.

Table of Contents

How PUPs Like ExpressFiles may be Distributed

Although PUPs may be distributed using normal threat distribution techniques (despite not being considered threats themselves), such as the use of attack websites, spam email messages or social engineering tactics, ExpressFiles and other PUPs' main form of distribution is a technique known as bundling. To do this, marketers will take programs like ExpressFiles and then bundle them with popular freeware applications, often hosted on low-quality software distribution platforms. When the computer users install these freeware programs, they may not realize that they come bundled with programs like ExpressFiles, installing the PUP on their computers in the process. Security researchers strongly advise computer users to follow the installation process carefully to prevent the entrance of any unwanted components when installing a new program on the affected computer. In almost every case, computer users may opt out of installing the PUP by selecting 'Custom' installation to detect all components being installed.

Removing ExpressFiles and Similar PUPs

PUPs like ExpressFiles may be uninstalled using normal software uninstallation methods. Once ExpressFiles has been uninstalled, however, undesirable changes to your Web browser's settings and files associated with ExpressFiles may remain. Because of this, the removal of ExpressFiles should be followed with the use of a reliable security program that is fully up-to-date and manual restoration of unwanted changes to your computer's settings may need to be done.

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software	Detection
Avast	Win32:Downloader-TSH [PUP]
AVG	Suspicion: unknown virus
Fortinet	W32/YourFileDownloader.B
Sophos	Generic PUA IA
McAfee-GW-Edition	Heuristic.LooksLike.Win32.SuspiciousPE.F
DrWeb	Tool.DownLoader.64
Comodo	UnclassifiedMalware
Avast	Win32:Dropper-gen [Drp]
McAfee	RDN/Generic Downloader.x!iq
CAT-QuickHeal	(Suspicious) - DNAScan
AVG	Faglaro Enterprises Limited
Symantec	Suspicious.Cloud
GData	Win32.Application.ExpressFiles.B
Avast	Win32:Expressfiles-C [PUP]
Avast	Win32:Malware-gen

SpyHunter Detects & Remove ExpressFiles

File System Details

ExpressFiles may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	ExpressFiles.exe	e4f87ee3d6d47104da46ac3fe8f0a0b6	3,027
Name: ExpressFiles.exe MD5: e4f87ee3d6d47104da46ac3fe8f0a0b6 Size: 926.81 KB (926816 bytes) Detections: 3,027 Type: Executable File Path: C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe Group: Malware file Last Updated: November 4, 2022
2.	EFUpdater.exe	fa0f8558cbf4a4c1175f5bc1824cd253	2,718
Name: EFUpdater.exe MD5: fa0f8558cbf4a4c1175f5bc1824cd253 Size: 200.95 KB (200952 bytes) Detections: 2,718 Type: Executable File Path: C:\Program Files (x86)\ExpressFiles\EFUpdater.exe Group: Malware file Last Updated: October 5, 2023
3.	EFUpdater.exe	d79643bc1ea43d6393b8c6f6e0bbb28a	2,245
Name: EFUpdater.exe MD5: d79643bc1ea43d6393b8c6f6e0bbb28a Size: 1.02 MB (1029120 bytes) Detections: 2,245 Type: Executable File Path: %PROGRAMFILES%\ExpressFiles Group: Malware file Last Updated: September 7, 2022
4.	$RZ8MZOC.exe	0dd2d9d2719b7d9c332cfa28eaf9d3dd	1,142
Name: $RZ8MZOC.exe MD5: 0dd2d9d2719b7d9c332cfa28eaf9d3dd Size: 919.55 KB (919552 bytes) Detections: 1,142 Type: Executable File Path: C:\$Recycle.Bin\S-1-5-21-325025597-4190775166-3815817388-1000\$RZ8MZOC.exe Group: Malware file Last Updated: October 17, 2022
5.	uninstall464929.exe	76f6e8033be7099c2d26b130f336bc7d	1,040
Name: uninstall464929.exe MD5: 76f6e8033be7099c2d26b130f336bc7d Size: 488.08 KB (488088 bytes) Detections: 1,040 Type: Executable File Path: %SYSTEMDRIVE%\Users\<username>\AppData\Local\Temp\uninstall464929.exe Group: Malware file Last Updated: October 14, 2022
6.	EFUpdater.exe	617d02fa45678fbe403e85838b93fbda	717
Name: EFUpdater.exe MD5: 617d02fa45678fbe403e85838b93fbda Size: 1.02 MB (1029120 bytes) Detections: 717 Type: Executable File Path: C:\Program Files (x86)\ExpressFiles\EFUpdater.exe Group: Malware file Last Updated: January 12, 2021
7.	expressdl.exe	93e54c3adc6fec8e5f100180143ac200	712
Name: expressdl.exe MD5: 93e54c3adc6fec8e5f100180143ac200 Size: 1.63 MB (1636088 bytes) Detections: 712 Type: Executable File Path: C:\Program Files (x86)\ExpressFiles\expressdl.exe Group: Malware file Last Updated: October 5, 2023
8.	ExpressFiles.exe	0094df60653a6183ac40b620c3d244e8	655
Name: ExpressFiles.exe MD5: 0094df60653a6183ac40b620c3d244e8 Size: 984.06 KB (984064 bytes) Detections: 655 Type: Executable File Path: C:\Users\<username>\Desktop\Ales PC Redjan\Programe\express\ExpressFiles.exe Group: Malware file Last Updated: January 17, 2024
9.	expressdl.exe	533b4d00ac7d7be7e3e8c8f1c2ec38b5	565
Name: expressdl.exe MD5: 533b4d00ac7d7be7e3e8c8f1c2ec38b5 Size: 2.24 MB (2242048 bytes) Detections: 565 Type: Executable File Path: C:\Programmi\ExpressFiles\expressdl.exe Group: Malware file Last Updated: April 13, 2023
10.	expressdl.exe	d00fae89be24c6a42566b1d81b922b30	510
Name: expressdl.exe MD5: d00fae89be24c6a42566b1d81b922b30 Size: 1.73 MB (1735264 bytes) Detections: 510 Type: Executable File Path: C:\Program Files (x86)\ExpressFiles\expressdl.exe Group: Malware file Last Updated: November 4, 2022
11.	EFUpdater.exe	79ebd77c22501221ab73a4549c9fdbf2	216
Name: EFUpdater.exe MD5: 79ebd77c22501221ab73a4549c9fdbf2 Size: 249.44 KB (249440 bytes) Detections: 216 Type: Executable File Path: C:\Program Files (x86)\ExpressFiles\EFUpdater.exe Group: Malware file Last Updated: June 24, 2022
12.	expressdl.exe	ee13d0a327cd79998d25824f0eae2c54	214
Name: expressdl.exe MD5: ee13d0a327cd79998d25824f0eae2c54 Size: 1.62 MB (1621656 bytes) Detections: 214 Type: Executable File Path: G:\Program Files (x86)\ExpressFiles\expressdl.exe Group: Malware file Last Updated: June 25, 2022
13.	uninstall83772318.exe	708ede8d0a6353bebd6a7609fa594d4c	84
Name: uninstall83772318.exe MD5: 708ede8d0a6353bebd6a7609fa594d4c Size: 624.88 KB (624888 bytes) Detections: 84 Type: Executable File Path: %SYSTEMDRIVE%\Users\<username>\AppData\Local\Temp\uninstall83772318.exe Group: Malware file Last Updated: October 5, 2023
14.	EFUpdater.exe	f8d119dbba480f326e8801068caac4a6	82
Name: EFUpdater.exe MD5: f8d119dbba480f326e8801068caac4a6 Size: 200.34 KB (200344 bytes) Detections: 82 Type: Executable File Path: G:\Program Files (x86)\ExpressFiles\EFUpdater.exe Group: Malware file Last Updated: December 20, 2021
15.	EFUpdater.exe	a424f3afc085f5f35a12836e36d8c787	63
Name: EFUpdater.exe MD5: a424f3afc085f5f35a12836e36d8c787 Size: 1.02 MB (1029120 bytes) Detections: 63 Type: Executable File Path: %PROGRAMFILES%\ExpressFiles Group: Malware file Last Updated: September 16, 2014
16.	EFUpdater.exe	65422fe0c48baa495de6777527340077	48
Name: EFUpdater.exe MD5: 65422fe0c48baa495de6777527340077 Size: 1.02 MB (1029120 bytes) Detections: 48 Type: Executable File Path: %PROGRAMFILES(x86)%\ExpressFiles Group: Malware file Last Updated: September 16, 2014
17.	EFUpdater.exe	9e877d5a1ee517f258dd489b48d48d79	47
Name: EFUpdater.exe MD5: 9e877d5a1ee517f258dd489b48d48d79 Size: 249.44 KB (249440 bytes) Detections: 47 Type: Executable File Path: %PROGRAMFILES%\ExpressFiles Group: Malware file Last Updated: September 16, 2014
18.	EFupdater.exe	88ea4ba7ad5dcd53e297433da6e388d8	37
Name: EFupdater.exe MD5: 88ea4ba7ad5dcd53e297433da6e388d8 Size: 249.44 KB (249440 bytes) Detections: 37 Type: Executable File Path: C:\Program Files\ExpressFiles\EFupdater.exe Group: Malware file Last Updated: August 20, 2023
19.	uninstall1302328.exe	f695008e91430af040cad5173e423d63	36
Name: uninstall1302328.exe MD5: f695008e91430af040cad5173e423d63 Size: 919.55 KB (919552 bytes) Detections: 36 Type: Executable File Path: F:\Documents and Settings\JGM\Configuración local\Temp\uninstall1302328.exe Group: Malware file Last Updated: April 11, 2022
20.	ExpressFiles.exe	368926f60ffef112fcb149e16af0a2af	22
Name: ExpressFiles.exe MD5: 368926f60ffef112fcb149e16af0a2af Size: 476.82 KB (476824 bytes) Detections: 22 Type: Executable File Path: %PROGRAMFILES%\ExpressFiles Group: Malware file Last Updated: May 23, 2020
21.	ExpressFiles.exe	82168fe5fd5c8293ef2a96ae83ef0c3a	17
Name: ExpressFiles.exe MD5: 82168fe5fd5c8293ef2a96ae83ef0c3a Size: 926.81 KB (926816 bytes) Detections: 17 Type: Executable File Path: %PROGRAMFILES%\ExpressFiles Group: Malware file Last Updated: September 16, 2014
22.	ExpressFiles.exe	f49b3e52c2a8f79301c0e239c1c8f9e8	14
Name: ExpressFiles.exe MD5: f49b3e52c2a8f79301c0e239c1c8f9e8 Size: 624.79 KB (624792 bytes) Detections: 14 Type: Executable File Path: %PROGRAMFILES%\ExpressFiles Group: Malware file Last Updated: September 7, 2018
23.	EFUpdater.exe	6bfd658c9d602729517af692255c357e	10
Name: EFUpdater.exe MD5: 6bfd658c9d602729517af692255c357e Size: 200.95 KB (200952 bytes) Detections: 10 Type: Executable File Path: %PROGRAMFILES%\ExpressFiles Group: Malware file Last Updated: September 16, 2014

More files

Registry Details

ExpressFiles may create the following registry entry or registry entries:

Regexp file mask

%WINDIR%\System32\Tasks\Express FilesUpdate

%WINDIR%\Tasks\Express FilesUpdate.job

HKEY..\..\..\..{RegistryKeys}

Software\ExpressFiles

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Express FilesUpdate

Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\C:\ProgramData\Microsoft\Windows\Start Menu\ExpressFiles\Express Files.lnk

Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles

SOFTWARE\Wow6432Node\ExpressFiles

Directories

ExpressFiles may create the following directory or directories:

%APPDATA%\ExpressFiles

%AllUsersProfile%\Microsoft\Windows\Start Menu\ExpressFiles

%PROGRAMFILES%\ExpressFiles

%PROGRAMFILES(X86)%\ExpressFiles

EnigmaSoft's SpyHunter Scores 100% with AV-TEST in 2024

Search

Change Region

ExpressFiles

Threat Scorecard

EnigmaSoft Threat Scorecard

How PUPs Like ExpressFiles may be Distributed

Removing ExpressFiles and Similar PUPs

Aliases

SpyHunter Detects & Remove ExpressFiles

File System Details

Registry Details

Directories

Submit Comment

Trending

PDFSpark

Uazq Ransomware

Uajs Ransomware

Most Viewed

Discord Shows Black Screen when Sharing Screen

How To Fix 'Printer Driver is Unavailable' Error

What is Msedge.exe?