Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)

[HcH]

Title:

Politie Korps Landelijk Politiediensten

Openbaar Ministerie
CYBERCRIME POLITIE NEDERLAND

Use Paysafecard or Ukash to unlock your system.

ATTENTIE! Uw persoonlijke computer wordt geblokkeerd om veiligheidsoverwegingen wegens de hieronder aangegeven redenen.

This is a scam ofcourse! Read below for removal instructions.

Location on XP:
%appdata%\Other.res

Location on Windows 7:
%appdata%\roaming

Registry location:

Code: [Select]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

"shell"="explorer.exe,C:\\Documents and Settings\\%USERNAME%\\Application Data\\Other.res"

Removal:
1. Search for "Other.res" in the registry, remove the "Other.res" part of the key mentioned above, explorer.exe must remain there.
2. The file, Other.res is a system file, modify your explorer to view hidden and system files, remove it. (or use CMD:
* navigate to the location of Other.res, on Vista and Windows 7 it's located in "%appdata%\roaming", on XP %appdata%, enter "cd %APPDATA%(\roaming)",
* enter "attrib -r -s -a-h",
* "del Other.res"
* "dir *.exe" , "del any suspicious 7 letter generated filenames"

Notes:
* To enter the pc, use another account.
* When you use another account the key for other users it's a subkey of HKEY_USERS instead of the location mentioned above.
* If no other account is available, use a bootable Linux or Win PE. Raw load the user's NTUSER.DAT.
* There also is executable which is located also in %APPDATA% of 184 kB (189.208 bytes), it seems to have a generated filename, in my case it was "cisvlpr.exe", this is the lockscreen.
* It seems to get a certificate from http://repository.certum.pl/ctnca.cer, then uses that to secure the connection.

HcH

[cvegreen]

Thx mate, i will send it to my wife, se had one like that more than a year ago on her computer. i can tell you, it was verrry hard to remove it. i believe that che dit a complete reinstall of her computer.

[HcH]

Thx mate, i will send it to my wife, se had one like that more than a year ago on her computer. i can tell you, it was verrry hard to remove it. i believe that che dit a complete reinstall of her computer.

Hey Chris,

Wow! Even a reinstall, darn! True indeed, this one, same one, was active last year but this one has been changed, at my work, the antivirus of the mailserver and client antivirus failed detecting this one, MalwareBytes did find the lockscreen but did not fix the white screen you get when removing just the lockscreen Same picture, different trick this time!

Cheers,

HcH

[cvegreen]

Thx mate, i will send it to my wife, se had one like that more than a year ago on her computer. i can tell you, it was verrry hard to remove it. i believe that che dit a complete reinstall of her computer.

Hey Chris,

Wow! Even a reinstall, darn! True indeed, this one, same one, was active last year but this one has been changed, at my work, the antivirus of the mailserver and client antivirus failed detecting this one, MalwareBytes did find the lockscreen but did not fix the white screen you get when removing just the lockscreen Same picture, different trick this time!

Cheers,

HcH

Hey HcH
Yes che dit a reinstall, i asked her. Che could do annything. directly the white screen and that you have to pay .

[HcH]

Hey Chris,

That's sure a waste! I hope she did not lose any important data!

Ah well, if she gets it now you know me

Some nerd-power will fix it!

HcH

[cvegreen]

Hey HcH,
No che ditn lose importend data, che saves importend data on a second drive.

[HcH]

Hey HcH,
No che ditn lose importend data, che saves importend data on a second drive.

That is most wise! Good thing there was a backup!

[cvegreen]

that sommething we both dont anderstand. We know wath it means and wath it does, but how jou do it. Make a backup is not dat dificult, but than?

[HcH]

that sommething we both dont anderstand. We know wath it means and wath it does, but how jou do it. Make a backup is not dat dificult, but than?

That depends on the kind of backup you make, I usually just backup important folders from my hard drive to an external one using the most awesome synchronization / backup tool ever done by mankind: DSynchronize, which is unbelievable but truly freeware: http://dimio.altervista.org/eng/ , this way I sync only changed and added files, fast and easy.

For scripted backup this tool is ALSO great but another nice way is Microsoft's own Robocopy, a little technical but very powerful.

HcH

[Bishlovx]

It is good that we are involved in the question that came up.