Page 1 of 1

Itibiti.exe.. Possible Snooper?

PostPosted: Thu Feb 11, 2016 4:20 pm
by Karlsweldt
Was wondering why my Win 7 setup doing F@H has had unusual activity now and then, searching the optical drives when no disks are there. Did a check on active processes, and found this "Itibiti.exe" program. A search of it turned up the possibility that it is a PUP, or 'Potentially Unwanted Program".
"Description: Itibiti.exe is not essential for Windows and will often cause problems. Itibiti.exe is located in a subfolder of "C:\Program Files". Known file sizes on Windows 10/8/7/XP are 7,342,080 bytes (66% of all occurrences), 5,276,672 bytes, 7,334,400 bytes or 5,284,352 bytes.
There is no description of the program. Itibiti.exe is not a Windows system file. The program is not visible. The software starts when Windows starts (see Registry key: Run). Itibiti.exe is able to connect to the Internet, record keyboard and mouse inputs, monitor applications, hide itself and manipulate other programs. Therefore the technical security rating is 60% dangerous; however you should also read the user reviews."

Possibly installed as part of a VoIP program.
I have disabled it from the "Start up" roster with 'msconfig'. No phone service using VoIP needed! Don't like what it could do.

Re: Itibiti.exe.. Possible Snooper?

PostPosted: Sun Feb 14, 2016 8:21 am
by evasive
I opened the task manager, closed ltibiti.exe and immediately uninstalled KNCTR from add/remove programs.

AdWare of some sort.

Re: Itibiti.exe.. Possible Snooper?

PostPosted: Mon Feb 15, 2016 1:48 am
by Toby B.
not sure about the itibiti.exe but have seen KNCTR before... In fact I am trying to clean things up after a second infection where KNCTR got install...

the pisser in my case everything "looks clean" but still have a random twitch. 10+ new Anti-sh*tware program I install I find something else. Not sure at this point what is false positives and what is not.

I have used guidelines on bleeping computer for removal of both my infections and still got the twitch...

from my combofix log:
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
"MySQL Notifier"="c:\program files (x86)\MySQL\MySQL Notifier 1.1\MySqlNotifier.exe" [2014-09-04 773120]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2016-01-15 8619224]
"Itibiti.exe"="c:\program files (x86)\Itibiti Soft Phone\Itibiti.exe" [2013-06-26 7342080]

would recommend searching your system for the itibiti file.. and doing a thorough system check for crapware...

Re: Itibiti.exe.. Possible Snooper?

PostPosted: Mon Feb 15, 2016 6:28 am
by Karlsweldt
From a search of "What is KNCTR" several links note it is a free program that is ad supported, and allows a user to make free phone calls on a land line or on the Internet! Associated with Itibiti.exe.
Recommended to remove them totally. Deactivate, uninstall, then delete any remnants manually.
Could have come from a pop-up ad that you try to close by clicking the [X] box on the ad. GOTCHA!
Safer to right-click the task bar tab, close that app.