As this program requires Administrative privileges to run, some ransomware will inject themselves into processes that are running as an Administrator in order to avoid a UAC prompt from being displayed.Īs vssadmin.exe is not a tool that is routinely used by an administrator, it is strongly suggested that it be disabled it by renaming it. This command will execute the vssadmin.exe utility and have it quietly delete all of the Shadow Volume Copies on the computer. There are a few methods that the ransomware malware developers use to delete the Shadow Volume Copies, but the most prevalent one is to use the vssadmin.exe Delete Shadows /All /Quiet command. This is done to prevent you from using Shadow Volumes to recover encrypted files. Unfortunately, the developers of Crypto Ransomware are aware of Shadow Volume Copies and design their infections so that they delete ALL Shadow Volume Copies when the ransomware infects your computer. Though this shouldn't be considered a regular backup method, it does provide an extra security blanket in the event that you need to restore a changed or deleted file.
Since the standard save location for Document files is on the C: drive your documents will be backed up as well. System Restore is a feature that relies on Shadow Volume Copiesīy default, Windows will attempt to create new Shadow Volume snapshots of your C: drive every day.
Unfortunately, with the rise of Crypto Ransomware, this tool has become more of a problem than a benefit and everyone should disable it. Since Windows Vista, Microsoft has been bundling a utility called vssadmin.exe in Windows that allows an administrator to manage the Shadow Volume Copies that are on the computer. This same technology is also used by the Windows' System Restore feature that allows you to roll back Windows to a previously working configuration in case there is a problem. These snapshots will attempt to be created every day and allows you to restore documents to previous versions or even to restore them if they were deleted. Shadow Volume Copies have been a feature since Windows Vista that allows snapshots, or backups, of your files to be saved even when the files are currently in use.
0 kommentar(er)
