Solved! Use CKSETUP32.EXE (Unclassified Malware) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

CKSETUP32.EXE – Unclassified Malware removal

CKSETUP32.EXE size: 2809352 bytes
CKSETUP32.EXE hash: FC941B4F721B229905217C1E601360E1

Created files:

%WinDir%\Downloaded Program Files\TouchEnKey.dll
%SysDir%\CKAgent.exe
%SysDir%\CKApp.dll
%SysDir%\CKCSP.dll
%SysDir%\CKKeyProCert.dll
%SysDir%\CKSetup32.exe
%SysDir%\JRSKD24.SYS
%SysDir%\jrsoftcp.dll
%SysDir%\JRSUKD25.SYS
%SysDir%\kcrtx86.sys
%SysDir%\Kcrypto.dll
%SysDir%\keysharpcrypto.dll
%SysDir%\npKeyPro.dll
%SysDir%\TouchEnKey.dll
%SysDir%\XecureCK.dll

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\JRSKD24\Type: 01000000
HKLM\System\CurrentControlSet\Services\JRSKD24\Start: 03000000
HKLM\System\CurrentControlSet\Services\JRSKD24\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\JRSKD24\DisplayName: JRSKD24
HKLM\System\CurrentControlSet\Services\JRSKD24\ImagePath: 5C003F003F005C0043003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C004A00520053004B004400320034002E005300590053000000
HKLM\System\CurrentControlSet\Services\kcrtx86\Type: 01000000
HKLM\System\CurrentControlSet\Services\kcrtx86\Start: 03000000
HKLM\System\CurrentControlSet\Services\kcrtx86\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\kcrtx86\DisplayName: kcrtx86
HKLM\System\CurrentControlSet\Services\kcrtx86\ImagePath: %WinDir%\System32\kcrtx86.sys

Detected by UnHackMe:

CKSETUP32.EXE
Default location: %SYSDIR%\CKSETUP32.EXE

Dropper information:
MD5: a572318225984cfe8529a2319552e661
File size: 3863544 bytes

Leave a Reply