TechKnow

Author Topic: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)  (Read 3722 times)

0 Members and 1 Guest are viewing this topic.

Offline HcH

  • TechKnow Owner, Ethical Hacker
  • Administrator
  • Uber Member
  • *****
  • Posts: 9883
  • Karma: +2282/-108


Title:

Politie Korps Landelijk Politiediensten

Openbaar Ministerie
CYBERCRIME POLITIE NEDERLAND

Use Paysafecard or Ukash to unlock your system.

ATTENTIE! Uw persoonlijke computer wordt geblokkeerd om veiligheidsoverwegingen wegens de hieronder aangegeven redenen.


This is a scam ofcourse! Read below for removal instructions.


Location on XP:
%appdata%\Other.res

Location on Windows 7:
%appdata%\roaming

Registry location:
Code: [Select]
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

"shell"="explorer.exe,C:\\Documents and Settings\\%USERNAME%\\Application Data\\Other.res"

Removal:
1. Search for "Other.res" in the registry, remove the "Other.res" part of the key mentioned above, explorer.exe must remain there.
2. The file, Other.res is a system file, modify your explorer to view hidden and system files, remove it. (or use CMD:
* navigate to the location of Other.res, on Vista and Windows 7 it's located in "%appdata%\roaming", on XP %appdata%, enter "cd %APPDATA%(\roaming)",
* enter "attrib -r -s -a-h",
* "del Other.res"
* "dir *.exe" , "del any suspicious 7 letter generated filenames"

Notes:
* To enter the pc, use another account.
* When you use another account the key for other users it's a subkey of HKEY_USERS instead of the location mentioned above.
* If no other account is available, use a bootable Linux or Win PE. Raw load the user's NTUSER.DAT.
* There also is executable which is located also in %APPDATA% of 184 kB (189.208 bytes), it seems to have a generated filename, in my case it was "cisvlpr.exe", this is the lockscreen.
* It seems to get a certificate from http://repository.certum.pl/ctnca.cer, then uses that to secure the connection.

HcH
« Last Edit: October 11, 2016, 04:37:02 PM by HardcoreHacker »

Offline cvegreen

  • VIP Moderator
  • Full Member
  • *
  • Posts: 199
  • Karma: +99/-0
  • Tablet / Size / Model: no tablet, asus F205TA netbook
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #1 on: December 18, 2014, 09:49:30 PM »
Thx mate, i will send it to my wife, se had one like that more than a year ago on her computer. i can tell you, it was verrry hard to remove it. i believe that che dit a complete reinstall of her computer.

Offline HcH

  • TechKnow Owner, Ethical Hacker
  • Administrator
  • Uber Member
  • *****
  • Posts: 9883
  • Karma: +2282/-108
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #2 on: December 18, 2014, 10:26:57 PM »
Thx mate, i will send it to my wife, se had one like that more than a year ago on her computer. i can tell you, it was verrry hard to remove it. i believe that che dit a complete reinstall of her computer.
Hey Chris,

Wow! Even a reinstall, darn! True indeed, this one, same one, was active last year but this one has been changed, at my work, the antivirus of the mailserver and client antivirus failed detecting this one, MalwareBytes did find the lockscreen but did not fix the white screen you get when removing just the lockscreen ;) Same picture, different trick this time!

Cheers,

HcH

Offline cvegreen

  • VIP Moderator
  • Full Member
  • *
  • Posts: 199
  • Karma: +99/-0
  • Tablet / Size / Model: no tablet, asus F205TA netbook
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #3 on: December 18, 2014, 10:40:59 PM »
Thx mate, i will send it to my wife, se had one like that more than a year ago on her computer. i can tell you, it was verrry hard to remove it. i believe that che dit a complete reinstall of her computer.
Hey Chris,

Wow! Even a reinstall, darn! True indeed, this one, same one, was active last year but this one has been changed, at my work, the antivirus of the mailserver and client antivirus failed detecting this one, MalwareBytes did find the lockscreen but did not fix the white screen you get when removing just the lockscreen ;) Same picture, different trick this time!

Cheers,

HcH
Hey HcH
Yes che dit a reinstall, i asked her. Che could do annything. directly the white screen and that you have to pay .

Offline HcH

  • TechKnow Owner, Ethical Hacker
  • Administrator
  • Uber Member
  • *****
  • Posts: 9883
  • Karma: +2282/-108
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #4 on: December 18, 2014, 10:45:18 PM »
Hey Chris,

That's sure a waste! I hope she did not lose any important data!

Ah well, if she gets it now you know me :android-nerd:

Some nerd-power will fix it!

HcH

Offline cvegreen

  • VIP Moderator
  • Full Member
  • *
  • Posts: 199
  • Karma: +99/-0
  • Tablet / Size / Model: no tablet, asus F205TA netbook
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #5 on: December 19, 2014, 12:20:57 PM »
Hey HcH,
No che ditn lose importend data, che saves importend data on a second drive.

Offline HcH

  • TechKnow Owner, Ethical Hacker
  • Administrator
  • Uber Member
  • *****
  • Posts: 9883
  • Karma: +2282/-108
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #6 on: December 19, 2014, 12:28:28 PM »
Hey HcH,
No che ditn lose importend data, che saves importend data on a second drive.
That is most wise! Good thing there was a backup!

Offline cvegreen

  • VIP Moderator
  • Full Member
  • *
  • Posts: 199
  • Karma: +99/-0
  • Tablet / Size / Model: no tablet, asus F205TA netbook
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #7 on: December 19, 2014, 11:00:28 PM »
that sommething we both dont anderstand. We know wath it means and wath it does, but how jou do it. Make a backup is not dat dificult, but than?

Offline HcH

  • TechKnow Owner, Ethical Hacker
  • Administrator
  • Uber Member
  • *****
  • Posts: 9883
  • Karma: +2282/-108
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #8 on: December 20, 2014, 09:30:44 PM »
that sommething we both dont anderstand. We know wath it means and wath it does, but how jou do it. Make a backup is not dat dificult, but than?
That depends on the kind of backup you make, I usually just backup important folders from my hard drive to an external one using the most awesome synchronization / backup tool ever done by mankind: DSynchronize, which is unbelievable but truly freeware: http://dimio.altervista.org/eng/ , this way I sync only changed and added files, fast and easy.

For scripted backup this tool is ALSO great but another nice way is Microsoft's own Robocopy, a little technical but very powerful.

HcH

Offline Bishlovx

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
  • Uber-Noobie
Re: Politie Lockscreen (Interpol) verwijderen/removal (Ukash/Paysafecard)
« Reply #9 on: February 23, 2018, 04:43:01 AM »
It is good that we are involved in the question that came up.