6 Responses for "rncsys32.exe"

1. dc June 15th, 2009 at 5:42 am 1

   think this is pretty new. detected slight increase in network traffic activity.

   sits in start up folder, no other source exes or files it links to/references found on the pc (so far..)

   anyone has more details abt it’s origins/what it is related to, what it might do etc?

   - dc

2. lek June 29th, 2009 at 3:43 pm 2

   I just got this virus in my computer.
   Fortunately, my antivirus can delete it!

   PS: I found this virus in my startup.

3. bob July 2nd, 2009 at 11:42 pm 3

   This trojan steals ftp ids (stored where? filezilla maybe?) and inserts some iframe tags into whatever php files it can found, preferably index.php files.

   Whenever this tag is read by a client, he is contaminated with rncsys32.exe (if lack of protection).

4. Chris July 14th, 2009 at 6:10 pm 4

   Found this on both computers in my house; probably transferred by a flash drive. Still not sure how it was conceived on the computers, but it was very frustrating. Re-routes all “Google” search results to a php error page.

5. fernanda July 22nd, 2009 at 5:23 am 5

   It happened to me. The site of a client started to going wrong, showing blank pages. When I was searching the code, I saw that it had been mysteriously added a that directs to a site called “q1n.in” in all of my index and default pages. I contacted my host’s support and they said I was hacked. Not understand, because the files were all on the server and the password remains the same. Turning the antivirus on my machine I saw that I was more a victim of this trojan …

6. rqqt August 24th, 2009 at 11:21 am 6

   this malware can hijack server files … piggys back to your other network machines.

   I has got infected by this pairup:
   rncsys32.exe
   kovin32.exe