Itibiti.exe.. Possible Snooper?

Help and Discussion

Moderator: The Mod Squad

Itibiti.exe.. Possible Snooper?

Postby Karlsweldt » Thu Feb 11, 2016 4:20 pm

Was wondering why my Win 7 setup doing F@H has had unusual activity now and then, searching the optical drives when no disks are there. Did a check on active processes, and found this "Itibiti.exe" program. A search of it turned up the possibility that it is a PUP, or 'Potentially Unwanted Program".
http://www.file.net/process/itibiti.exe.html
"Description: Itibiti.exe is not essential for Windows and will often cause problems. Itibiti.exe is located in a subfolder of "C:\Program Files". Known file sizes on Windows 10/8/7/XP are 7,342,080 bytes (66% of all occurrences), 5,276,672 bytes, 7,334,400 bytes or 5,284,352 bytes. http://www.file.net/process/itibiti.exe.html
There is no description of the program. Itibiti.exe is not a Windows system file. The program is not visible. The software starts when Windows starts (see Registry key: Run). Itibiti.exe is able to connect to the Internet, record keyboard and mouse inputs, monitor applications, hide itself and manipulate other programs. Therefore the technical security rating is 60% dangerous; however you should also read the user reviews."

Possibly installed as part of a VoIP program.
I have disabled it from the "Start up" roster with 'msconfig'. No phone service using VoIP needed! Don't like what it could do.
F@H.. to solve mankind's maladies.. in our lifetimes!
Karlsweldt
Mobo-fu Master
Mobo-fu Master
 
Posts: 20690
Joined: Wed Nov 12, 2003 11:57 am
Location: 07438

Re: Itibiti.exe.. Possible Snooper?

Postby evasive » Sun Feb 14, 2016 8:21 am

I opened the task manager, closed ltibiti.exe and immediately uninstalled KNCTR from add/remove programs.


AdWare of some sort.
We hate rut, but we fear change.
********************************
System error, strike any user to continue...
evasive
Mobo-fu Master
Mobo-fu Master
 
Posts: 37389
Joined: Sun May 06, 2001 12:01 am
Location: Netherlands

Re: Itibiti.exe.. Possible Snooper?

Postby Toby B. » Mon Feb 15, 2016 1:48 am

not sure about the itibiti.exe but have seen KNCTR before... In fact I am trying to clean things up after a second infection where KNCTR got install...

the pisser in my case everything "looks clean" but still have a random twitch. 10+ new Anti-sh*tware program I install I find something else. Not sure at this point what is false positives and what is not.

I have used guidelines on bleeping computer for removal of both my infections and still got the twitch...

from my combofix log:
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MySQL Notifier"="c:\program files (x86)\MySQL\MySQL Notifier 1.1\MySqlNotifier.exe" [2014-09-04 773120]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2016-01-15 8619224]
"Itibiti.exe"="c:\program files (x86)\Itibiti Soft Phone\Itibiti.exe" [2013-06-26 7342080]


would recommend searching your system for the itibiti file.. and doing a thorough system check for crapware...
Toby B.
Lead Mobo-fu Master
Lead Mobo-fu Master
 
Posts: 14277
Joined: Sun Dec 16, 2001 1:01 am
Location: Maine

Re: Itibiti.exe.. Possible Snooper?

Postby Karlsweldt » Mon Feb 15, 2016 6:28 am

From a search of "What is KNCTR" several links note it is a free program that is ad supported, and allows a user to make free phone calls on a land line or on the Internet! Associated with Itibiti.exe.
Recommended to remove them totally. Deactivate, uninstall, then delete any remnants manually.
Could have come from a pop-up ad that you try to close by clicking the [X] box on the ad. GOTCHA!
Safer to right-click the task bar tab, close that app.
F@H.. to solve mankind's maladies.. in our lifetimes!
Karlsweldt
Mobo-fu Master
Mobo-fu Master
 
Posts: 20690
Joined: Wed Nov 12, 2003 11:57 am
Location: 07438


Return to Virus/Spyware/Security

Who is online

Users browsing this forum: No registered users and 1 guest