I'm studying and listing ransomware family.(like CryptoWall, TorrentLocker, CTB-Locker, .etc)

When I read the features of those family, they do vssadmin.exe to delete shadow copies of victim's PC so that victim can't recover.

So is it possible? If I can hook vssadmin, the vssadmin process is paused until additional authentication (like face recognition in your laptop cam).

In other words, ransomware are not allowed to delete shadow copy. So if users are attacked by ransomware, user can recover some files.(even though, from certain date in shadow copy to current data are lost)

Thank you

1 Answer 1


Yes, but wouldn't you also need to hook wmic shadowcopy delete as well as other ways to do this?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .