Title:Politie Korps Landelijk Politiediensten
Openbaar Ministerie
CYBERCRIME POLITIE NEDERLAND
Use Paysafecard or Ukash to unlock your system.
ATTENTIE! Uw persoonlijke computer wordt geblokkeerd om veiligheidsoverwegingen wegens de hieronder aangegeven redenen.This is a scam ofcourse! Read below for removal instructions.

Location on XP:%appdata%\Other.resLocation on Windows 7:%appdata%\roamingRegistry location:Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"shell"="explorer.exe,C:\\Documents and Settings\\%USERNAME%\\Application Data\\Other.res"
Removal:1. Search for
"Other.res" in the registry, remove the "Other.res" part of the key mentioned above, explorer.exe must remain there.
2. The file, Other.res is a system file, modify your explorer to view hidden and system files, remove it. (or use CMD:
* navigate to the location of Other.res, on Vista and Windows 7 it's located in
"%appdata%\roaming", on XP %appdata%, enter
"cd %APPDATA%(\roaming)",
* enter
"attrib -r -s -a-h",
*
"del Other.res"* "dir *.exe" , "del any suspicious 7 letter generated filenames"
Notes:* To enter the pc, use another account.
* When you use another account the key for other users it's a subkey of HKEY_USERS instead of the location mentioned above.
* If no other account is available, use a bootable Linux or Win PE. Raw load the user's NTUSER.DAT.
* There also is executable which is located also in %APPDATA% of 184 kB (189.208 bytes), it seems to have a generated filename, in my case it was
"cisvlpr.exe", this is the lockscreen.
* It seems to get a certificate from
http://repository.certum.pl/ctnca.cer, then uses that to secure the connection.
HcH