Title:Politie Korps Landelijk PolitiedienstenLocation on XP:%appdata%\Other.resLocation on Windows 7:%appdata%\roamingRegistry location:
CYBERCRIME POLITIE NEDERLAND
Use Paysafecard or Ukash to unlock your system.
ATTENTIE! Uw persoonlijke computer wordt geblokkeerd om veiligheidsoverwegingen wegens de hieronder aangegeven redenen.
This is a scam ofcourse! Read below for removal instructions.
Windows Registry Editor Version 5.00Removal:
"shell"="explorer.exe,C:\\Documents and Settings\\%USERNAME%\\Application Data\\Other.res"
1. Search for "Other.res"
in the registry, remove the "Other.res" part of the key mentioned above, explorer.exe must remain there.
2. The file, Other.res is a system file, modify your explorer to view hidden and system files, remove it. (or use CMD:
* navigate to the location of Other.res, on Vista and Windows 7 it's located in "%appdata%\roaming"
, on XP %appdata%, enter "cd %APPDATA%(\roaming)"
* enter "attrib -r -s -a-h"
* "del Other.res"
* "dir *.exe" , "del any suspicious 7 letter generated filenames"Notes:
* To enter the pc, use another account.
* When you use another account the key for other users it's a subkey of HKEY_USERS instead of the location mentioned above.
* If no other account is available, use a bootable Linux or Win PE. Raw load the user's NTUSER.DAT.
* There also is executable which is located also in %APPDATA% of 184 kB (189.208 bytes), it seems to have a generated filename, in my case it was "cisvlpr.exe"
, this is the lockscreen.
* It seems to get a certificate from http://repository.certum.pl/ctnca.cer,
then uses that to secure the connection.