How does ransomware access OS and browser without asking the user?

Question

I have recently been infected by a ransomware (POLICE) malware after accessing to a supposedly inoffensive web page about "fuel injection drive data".

I didn't have suffient protection activated.

This piece of software copied an executable file into my hard drive and ran it straight away. The question is: How do the OS and browser allow this action without asking the user?

---

Some details. This happened last Dec 30th when I was trying to open this page “http://www.205gti.com/bosch/injectors.htm” which remained infected several days after and was signaled by the antivirus when I tried to open it again. Now it seams to be OK and is the first time I am able to open it and see its contents which is not much! The OS is XP Sp3 all updated. When It occurred I tried with all my tools to find the file that was running every time the XP was started (not in command mode) with no success. I started to get worried with how many times the system was reboot I think It wasn’t more the four times, by then I decided to restore a copy of the register three weeks older, next I run Malwarebytes (I had a nettop to help). Every thing came to normal. I would never suspect that Java runtime could have a security hole, I more though of an activeX.

To be honest and having a bunch of files and register keys in quarantine I don’t know which are the files or file responsible for the thread. I couldn't find even using autoruns.exe where the file was ¿?. I was much affected by the integrity of my system than to trap the nasty file. Thanks for the attn

Answer 1

It sounds like you're talking about the "Reveton" ransomware trojan and if this happened very recently then it might be linked to the latest Java exploit:

http://blog.trendmicro.com/trendlabs-security-intelligence/java-zero-day-exploit-in-the-wild-spreading-ransomware/

These attacks are based on security flaws within the Java plugin your browser uses to display Java applets.

In general it is best to disable Java in your browser unless you really need it. Also you really need some malware protection, after all there are plenty of free products around that work fine, e.g. AVAST. It would be helpful if you could give more information about your OS etc.