a) No intervention required although many start that way because people click on everything. The general idea is: get into a computer using any means possible and then spread using any means possible

b) They encrypt your files and make you pay usually with a time limit before they just delete the files