What is express-files Toolbar?

express-files Toolbar is software application developed by express-files. It is most commonly found on computers running Windows 7 with nearly 78.28% of installations running this operating system. express-files Toolbar's installer is typically 4.00 MB in size and installs around 19 files. The most common release is 6.10.3.27 with 45.58% of all installations currently using this version.

express-files Toolbar is most popular in the United States with 20.59% of installations residing in this country.

express-files Toolbar adds 2 scheduled tasks to the Windows Task Scheduler launching the program at randomly scheduled times. When using a computer that is connected to the internet, express-files Toolbar is known to create 1 firewall exception to allow inbound and outbound connectivity.

About express-files Toolbar?

The software installs OurToolbar, a browser toolbar compatible with Internet Explorer, Chrome, and Firefox. This toolbar is designed to enhance the user's browsing experience by offering personalized services and ads based on their web activity. Additionally, it can modify the browser's home page, search box, and auto-search settings, as well as perform redirects for "page not found" errors and daily auto-updates. It also integrates with the user's Facebook profile, with the user's permission, granting access to their profile feed and friends list for an enhanced browsing experience.

Multiple virus scanners have detected malware in express-files Toolbar.

uninstall.exe (MD5: b728fa6a309e5d18141947b95b730e95) has been flagged by 2 scanners:

Scanner Software	Version	Result
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	26380	Conduit (fs)

prxtbexpr.dll (MD5: 9117027aea464e41c60b87b9826e8447) has been flagged by 7 scanners:

Scanner Software	Version	Result
AVware	1.5.0.21	Conduit (fs)
Baidu-International	3.5.1.41473	PUA.Win32.Conduit.BX
ESET-NOD32	10641	a variant of Win32/Toolbar.Conduit.X
G Data	24	Win32.Application.Conduit.F
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	31234	Conduit (fs)
IKARUS anti.virus	T3.1.7.5.0	PUA.ClientConnect

ldrtbexpr.dll (MD5: 76b3946090c94bb38dbbca54ac8ff9f7) has been flagged by 3 scanners:

Scanner Software	Version	Result
ESET-NOD32	9264	a variant of Win32/Toolbar.Conduit.P
VIPRE Antivirus	25220	Conduit (fs)
Panda Antivirus	10.0.3.5	PUP/Conduit.A

express-filesToolbarHelper.exe (MD5: da11d78d765e4b8fa4cfa5a37e8a94ff) has been flagged by 6 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	Adware.Win32.Conduit.45
ESET-NOD32	10301	Win32/Toolbar.Conduit.Q
G Data	24	Win32.Adware.Conduit.B
IKARUS anti.virus	T3.1.7.5.0	PUA.ClientConnect
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	25220	Conduit (fs)

tbexpr.dll (MD5: 73406fa9287b36ca4163797c73a2cd04) has been flagged by 13 scanners:

Scanner Software	Version	Result
ESET-NOD32	7.9267	a variant of Win32/Toolbar.Conduit.B
VIPRE Antivirus	25244	Conduit (fs)
Antiy-AVL	1.0.0.1	GrayWare[WebToolbar:not-a-virus]/Win32.Agent.azm
AVware	1.5.0.21	Conduit (fs)
Baidu-International	3.5.1.41473	Adware.Win32.Conduit.M
Cyren	5.4.16.7	W32/Conduit.TTAU-0102
F-Prot	4.7.1.166	W32/Conduit.A
G Data	25	Win32.Application.Conduit.F
K7 AntiVirus	9.199.15118	Trojan ( 004b219d1 )
K7GW	9.199.15118	Trojan ( 004b219d1 )
Kaspersky	15.0.1.10	not-a-virus:WebToolbar.Win32.Agent.azm
Panda Antivirus	4.6.4.2	PUP/Conduit.A
IKARUS anti.virus	T3.1.7.5.0	PUA.ClientConnect

Software Behaviors

Firewall:

express-filesToolbarHelper.exe is added as a firewall exception for 'C:\Program Files\eTvOnline.ro\eTvOnline.roToolbarHelper.exe'.

Scheduled tasks:

uninstall.exe is scheduled as a task with the class '{42CD7A24-AF4B-44A0-A119-1C6F9B6E2A90}' (runs on registration).
express-filesToolbarHelper.exe is scheduled as a task with the class '{34C01E1F-1D33-4264-8F52-97E13432C5E2}' (runs on registration).

Software Details

URL:

https://expressfiles.ourtoolbar.com

Support:

https://expressfiles.ourtoolbar.com/help

Installation path:

C:\Program Files\express-files

Uninstaller:

C:\Program Files\express-files\uninstall.exe toolbar

Size:

4.00 MB

Language:

English

express-files Toolbar Executable Details

Primary executable:

tbexpr.dll

Name:

express-files Toolbar

Path:

C:\Program Files\express-files\tbexpr.dll

MD5:

73406fa9287b36ca4163797c73a2cd04

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

uninstall.exe

Malware

b728fa6a309e5d18141947b95b730e95

DLL

prxtbExp0.dll

4c163bd2a5905d18893ee311608e8c54

DLL

ldrtbExp0.dll

80b8d6336acb52b40795bb7bfcfde47d

DLL

tbExp0.dll

cff5ba48c0a792f3df818c4e0686209c

DLL

tbExp2.dll

ecd61a7b34713f5a9c123005fcb5d96e

DLL

hktbExp0.dll

4941f04ff9c6ba2317b32b9dd29deece

DLL

hk64tbExp0.dll

46c4dc04e70418ce1b1a2b94ca21e7b5

DLL

prxtbExp2.dll

ef30470fddd32d3d170594f017f3b985

DLL

ldrtbExp2.dll

a78fcb9066a02b0d1d4d155d1381b4b5

DLL

hktbExp2.dll

2b51962a1d0e61ae540104f2674f8649

File Type	Filename	MD5
EXE	uninstall.exe Malware	b728fa6a309e5d18141947b95b730e95
DLL	prxtbExp0.dll	4c163bd2a5905d18893ee311608e8c54
DLL	ldrtbExp0.dll	80b8d6336acb52b40795bb7bfcfde47d
DLL	tbExp0.dll	cff5ba48c0a792f3df818c4e0686209c
DLL	tbExp2.dll	ecd61a7b34713f5a9c123005fcb5d96e
DLL	hktbExp0.dll	4941f04ff9c6ba2317b32b9dd29deece
DLL	hk64tbExp0.dll	46c4dc04e70418ce1b1a2b94ca21e7b5
DLL	prxtbExp2.dll	ef30470fddd32d3d170594f017f3b985
DLL	ldrtbExp2.dll	a78fcb9066a02b0d1d4d155d1381b4b5
DLL	hktbExp2.dll	2b51962a1d0e61ae540104f2674f8649