Threat Scorecard

Ranking: 5,337
Threat Level: 10 % (Normal)
Infected Computers: 46,591
First Seen: January 3, 2014
Last Seen: July 15, 2024
OS(es) Affected: Windows

ExpressFiles is a Potentially Unwanted Program that may cause a wide variety of problems on affected computers. Potentially Unwanted Programs, usually represented using the acronym PUP, may be used by marketers to profit from advertising schemes and cause significant problems on affected computers. Software like ExpressFiles is marketed and promoted as a useful add-on for the computer user's Web browser commonly. However, in the vast majority of the cases, security researchers have observed that the many unwanted symptoms associated with these PUPs seldom warrants the supposed benefits that can be gained from using them. This happens because the prime function of these programs is to profit from advertising rather than delivering useful services to computer users.

How PUPs Like ExpressFiles may be Distributed

Although PUPs may be distributed using normal threat distribution techniques (despite not being considered threats themselves), such as the use of attack websites, spam email messages or social engineering tactics, ExpressFiles and other PUPs' main form of distribution is a technique known as bundling. To do this, marketers will take programs like ExpressFiles and then bundle them with popular freeware applications, often hosted on low-quality software distribution platforms. When the computer users install these freeware programs, they may not realize that they come bundled with programs like ExpressFiles, installing the PUP on their computers in the process. Security researchers strongly advise computer users to follow the installation process carefully to prevent the entrance of any unwanted components when installing a new program on the affected computer. In almost every case, computer users may opt out of installing the PUP by selecting 'Custom' installation to detect all components being installed.

Removing ExpressFiles and Similar PUPs

PUPs like ExpressFiles may be uninstalled using normal software uninstallation methods. Once ExpressFiles has been uninstalled, however, undesirable changes to your Web browser's settings and files associated with ExpressFiles may remain. Because of this, the removal of ExpressFiles should be followed with the use of a reliable security program that is fully up-to-date and manual restoration of unwanted changes to your computer's settings may need to be done.


15 security vendors flagged this file as malicious.

Anti-Virus Software Detection
Avast Win32:Downloader-TSH [PUP]
AVG Suspicion: unknown virus
Fortinet W32/YourFileDownloader.B
Sophos Generic PUA IA
McAfee-GW-Edition Heuristic.LooksLike.Win32.SuspiciousPE.F
DrWeb Tool.DownLoader.64
Comodo UnclassifiedMalware
Avast Win32:Dropper-gen [Drp]
McAfee RDN/Generic Downloader.x!iq
CAT-QuickHeal (Suspicious) - DNAScan
AVG Faglaro Enterprises Limited
Symantec Suspicious.Cloud
GData Win32.Application.ExpressFiles.B
Avast Win32:Expressfiles-C [PUP]
Avast Win32:Malware-gen

SpyHunter Detects & Remove ExpressFiles

File System Details

ExpressFiles may create the following file(s):
# File Name MD5 Detections
1. ExpressFiles.exe e4f87ee3d6d47104da46ac3fe8f0a0b6 3,028
2. EFUpdater.exe fa0f8558cbf4a4c1175f5bc1824cd253 2,719
3. EFUpdater.exe d79643bc1ea43d6393b8c6f6e0bbb28a 2,245
4. $RZ8MZOC.exe 0dd2d9d2719b7d9c332cfa28eaf9d3dd 1,142
5. uninstall464929.exe 76f6e8033be7099c2d26b130f336bc7d 1,040
6. EFUpdater.exe 617d02fa45678fbe403e85838b93fbda 717
7. expressdl.exe 93e54c3adc6fec8e5f100180143ac200 712
8. ExpressFiles.exe 0094df60653a6183ac40b620c3d244e8 656
9. expressdl.exe 533b4d00ac7d7be7e3e8c8f1c2ec38b5 565
10. expressdl.exe d00fae89be24c6a42566b1d81b922b30 511
11. EFUpdater.exe 79ebd77c22501221ab73a4549c9fdbf2 217
12. expressdl.exe ee13d0a327cd79998d25824f0eae2c54 214
13. uninstall83772318.exe 708ede8d0a6353bebd6a7609fa594d4c 85
14. EFUpdater.exe f8d119dbba480f326e8801068caac4a6 82
15. EFUpdater.exe a424f3afc085f5f35a12836e36d8c787 63
16. EFUpdater.exe 65422fe0c48baa495de6777527340077 48
17. EFUpdater.exe 9e877d5a1ee517f258dd489b48d48d79 47
18. EFupdater.exe 88ea4ba7ad5dcd53e297433da6e388d8 37
19. uninstall1302328.exe f695008e91430af040cad5173e423d63 36
20. ExpressFiles.exe 368926f60ffef112fcb149e16af0a2af 22
21. ExpressFiles.exe 82168fe5fd5c8293ef2a96ae83ef0c3a 17
22. ExpressFiles.exe f49b3e52c2a8f79301c0e239c1c8f9e8 14
23. EFUpdater.exe 6bfd658c9d602729517af692255c357e 10
More files

Registry Details

ExpressFiles may create the following registry entry or registry entries:
Regexp file mask
%WINDIR%\System32\Tasks\Express FilesUpdate
%WINDIR%\Tasks\Express FilesUpdate.job
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Express FilesUpdate
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\C:\ProgramData\Microsoft\Windows\Start Menu\ExpressFiles\Express Files.lnk


ExpressFiles may create the following directory or directories:

%AllUsersProfile%\Microsoft\Windows\Start Menu\ExpressFiles


Most Viewed