What is bill106.exe?

bill106.exe is part of mNqH and developed by TpeJ according to the bill106.exe version information.

bill106.exe's description is "jWYx"

bill106.exe is usually located in the 'c:\windows\' folder.

Some of the anti-virus scanners at VirusTotal detected bill106.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on bill106.exe:

PropertyValue
Product namemNqH
Company nameTpeJ
File descriptionjWYx
Internal namexICKFcBHgazOSE
Original filenamexICKFcBHgazOSE.exe
CommentsSMFh
Legal copyrightWzJG
Legal trademarkeGzG
Product version2.02.0002
File version2.02.0002

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product namemNqH
Company nameTpeJ
File descriptionjWYx
Internal namexICKFcBHgazOSE
Original filenamexICKFcBHgazOSE.exe
CommentsSMFh
Legal copyrightWzJG
Legal trademarkeGzG
Product version2.02.0002
File version2.02.0002

Digital signatures [?]

bill106.exe is not signed.

VirusTotal report

43 of the 45 anti-virus programs at VirusTotal detected the bill106.exe file. That's a 96% detection rate.

ScannerDetection Name
Agnitum Worm.Koobface!5aHo/Knuatg
AhnLab-V3 Worm/Win32.AutoRun
AntiVir BuyTR/Dropper.Gen
Avast Win32:Inject-ABT [Trj]
AVG BuyDropper.VB.CZI
BitDefender Worm.Generic.239511
CAT-QuickHeal Win32.Worm.VBNA.b.3.nop.b
ClamAV Win.Worm.Koobface-5
Commtouch W32/MalwareS.AGX
Comodo TrojWare.Win32.Trojan.Agent.Gen
DrWeb Win32.HLLW.Facebook.634
Emsisoft Net-Worm.Win32.Koobface.AMN (A)
eSafe Win32.TRDropper
ESET-NOD32 Win32/Koobface.NCT
F-Prot W32/MalwareS.AGX
F-Secure Worm:W32/Koobface.W
Fortinet W32/VBInjector.AGB!tr
GData Worm.Generic.239511
Ikarus Virus.Win32.VBInject
Jiangmin Worm/Koobface.ayp
K7AntiVirus Riskware
Kaspersky Net-Worm.Win32.Koobface.gha
Kingsoft Win32.Troj.Undef.(kcloud)
Malwarebytes BuyTrojan.Agent
McAfee Generic.dx!rac
McAfee-GW-Edition Generic.dx!rac
Microsoft VirTool:Win32/VBInject.EZ
MicroWorld-eScan Worm.Generic.239511
NANO-Antivirus Trojan.Win32.Koobface.rqno
Norman W32/Suspicious_Gen2.VEEZO
nProtect Worm/W32.Agent.81920.AN
Panda Trj/Genetic.gen
Rising Trojan.Win32.Generic.11E6991B
Sophos Mal/Koobface-B
SUPERAntiSpyware Trojan.Agent/Gen
Symantec Packed.Generic.296
TheHacker W32/Koobface.gha
TotalDefense Win32/Koobface.MW
TrendMicro WORM_KOOBFACE.GL
TrendMicro-HouseCall WORM_KOOBFACE.GL
VBA32 SScope.Trojan.VBRA.2331
VIPRE BuyVirTool.Win32.VBInject.gen.dg (v)
ViRobot Worm.Win32.S.Net-Koobface.81920
43 of the 45 anti-virus programs detected the bill106.exe file.

bill106.exe removal instructions

The instructions below shows how to remove bill106.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the bill106.exe file for removal, restart your computer and scan it again to verify that bill106.exe has been successfully removed. Here are the removal instructions in more detail:

  1. Download and install FreeFixer: http://www.freefixer.com/download.html
  2. Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
    Screenshot of Start Scan button
  3. When the scan is finished, locate bill106.exe in the scan result and tick the checkbox next to the bill106.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate bill106.exe in the scan result.
    Red arrow point on the unwanted file
    c:\windows\bill106.exe
  4. Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the bill106.exe file.
    Screenshot of Fix button
  5. Restart your computer.
  6. Start FreeFixer and scan your computer again. If bill106.exe still remains in the scan result, proceed with the next step. If bill106.exe is gone from the scan result you're done.
  7. If bill106.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
  8. Restart your computer.
  9. Start FreeFixer and scan your computer again. Verify that bill106.exe no longer appear in the scan result.
Please select the option that best describe your thoughts on the removal instructions given above








Free Questionnaires

Hashes [?]

PropertyValue
MD5c9f9e2f4d01bbc8fc2f312366971b06b
SHA256a30483d25afc50032adf190f1873a9298853b5a2d80036391f8f8d8e5190659d

Error Messages

These are some of the error messages that can appear related to bill106.exe:

bill106.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

bill106.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

jWYx has stopped working.

End Program - bill106.exe. This program is not responding.

bill106.exe is not a valid Win32 application.

bill106.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with bill106.exe?

To help other users, please let us know what you will do with bill106.exe:



What did other users do?

The poll result listed below shows what users chose to do with bill106.exe. 100% have voted for removal. Based on votes from 23 users.

Votes
Keep0 %
0
Remove100 %
23

NOTE: Please do not use this poll as the only source of input to determine what you will do with bill106.exe.

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

Roger Karlsson writes

4 thumbs

bill106.exe comes with the Koobface worm. It seems that the malware authors simply increase the number in the filename with each new release of the worm. So, we will likely see bill107.exe, bill108.exe, bill109.exe, bill110.exe, bill111.exe, bill112.exe, etc appearing in the near future.

This is how you can delete bill106.exe with FreeFixer:
1. Download and install FreeFixer: http://www.freefixer.com/download.html
2. Start FreeFixer and click "Scan". The scan will be finished in about 5 minutes.
3. In the scan result, locate items which mention bill106.exe, and check its "Delete" checkbox. bill106.exe usually appears under "Registry startups", "Processes" and/or "Recently created or modified files" in FreeFixer's scan result. DO NOT check anything else for removal, unless you are 100% sure it's malware.
4. Click "Fix" and restart your machine.
5. Start a FreeFixer scan again.
7. Verify that bill106.exe no longer appear anywhere in the scan result.
8. Done.

Did this completely remove the bill106.exe file from your computer?

# 7 Apr 2010, 13:38

Roger Karlsson writes

1 thumb

bill108.exe is listed here:
http://www.freefixer.com/library/file/56205/

# 22 Apr 2010, 7:19

Roger Karlsson writes

0 thumbs

Ran into bill109.exe today. More info here:
http://www.freefixer.com/library/file/57164/

# 6 May 2010, 5:08

Roger Karlsson writes

0 thumbs

bill110.exe listed here:
http://www.freefixer.com/library/file/57446/

# 12 May 2010, 2:57

Roger Karlsson writes

0 thumbs

bill111.exe info and removal instructions here:
http://www.freefixer.com/library/file/58672/

# 5 Jun 2010, 6:40

Roger Karlsson writes

0 thumbs

Stumbled upon bill112.exe today:
http://www.freefixer.com/library/file/58829/

The Koobface guys seems to update their downloader quite often. I suppose we will see bill113.exe, bill114.exe, bill115.exe, bill116.exe, etc, popping up shortly.

# 9 Jun 2010, 10:14

Roger Karlsson writes

0 thumbs

bill114.exe discovered today. More info here:
http://www.freefixer.com/library/file/59929/

# 8 Jul 2010, 1:29

Leave a reply