Ransomware is injected as a script which encrypts all the data and requires a ransom from us.

We don't have to open the script to execute it. It is self-executing.

How it will be able to access and encrypt all files without admin privilege?


from https://www.trendmicro.com/vinfo/us/security/definition/ransomware

Police ransomware is also notable for infecting user32.DLL, a known critical file. Infecting a critical file can be considered an evasion technique as it can help prevent detection by behavioral monitoring tools due to whitelisting. Additionally, cleaning critical files such as user32.DLL requires extra care as one misstep can crash a system, which could be seen as a possible obstacle for cleaning tools.

The infected user32.DLL performs a chain of routines that ends with the ransomware being loaded. It also locks the infected computer's screen and projects a “ransom” image, similar to previous police ransomware messages.

  • It is not a duplicate. The question is updated @techraf – i-- Mar 28 '17 at 6:07
  • If it was not a duplicate, why did you get an answer that is the same as under the other question? Did you downvote the answer and comment that it was wrong? – techraf Mar 28 '17 at 6:21
  • @techraf It is talking about user file encryption. But this one is not. Read the things in the blockquote. It won't allow to go to the desktop. – i-- Mar 28 '17 at 6:24
  • The answer is right according to my question before edit. It is my fault. I didn't be more specific. But now I edited it. @techraf – i-- Mar 28 '17 at 6:25
  • 1
    In your question you ask about crypto-ransomware (encrypting files) while the quote you've included is about police ransomware (blocking use of computer, but not encrypting). I think you need to be clear first what you are asking about. – Steffen Ullrich Mar 28 '17 at 6:47

It doesn't have to access ALL files in order to cause damage. It only has to encrypt files that the user created and cares about - family photographs, word documents, etc. The more of the user's files are locked, the worse the damage to the user, and the more likely they'll pay the ransom.

The user account already has all the privilege needed to access his own files.

| improve this answer | |
  • Thanks for your answer. But I am talking about Ransomeware that affect system files. Question edited. Please check it now – i-- Mar 28 '17 at 6:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.