First, of all: You are correct. Technically, nothing like this can happen unless you click something to activate the ransomware, but I see far too many end-users clicking on things they shouldn't, but don't know any better (i.e. "Your computer is infected, click here to repair."
But I've also seen it happen on an infected web server without any user interaction, or permission. I was looking for royalty-free stock images for a book cover I was designing. I'm in the habit of searching Google and then loading each of the results into their own tab (middle-click). So I must have opened at least 10 sites that looked promising. Some I hadn't heard of, but I was happy to try something new. Obviously I had opened a site with an infected server. Within seconds my entire screen was one big, giant ransom note. In this case, I believe the cause was my out-of-date Java runtime version known to have a security hole. I had intentionally let Java become outdated because I didn't want new versions messing up my programming environment. Ironic.
Your suggestions are good ones for regular, run-of-the-mill viruses and rogue programs, but they don't work with Ransomware. They might work, if you could do ANYTHING in Windows. But you can't. Ransomware, like Cryptolocker, LOCKS Windows. ALL you can see is the ransom screen. You cannot ESCape it. You have no access to Windows Explorer your mouse or your keyboard (other than to take actions to pay the ransom). You cannot CTRL+ALT+DELETE your way into Task Manager. You have NO access to Windows. No keyboard shortcuts to anything. Seems ridiculous, right? Unless you've seen it happen. Go ahead and restart the computer. It will reboot... right back into the ransom screen.
So here's what I learned (how to avoid, if that's possible) and how I got rid of it (thankfully whatever ransomware variant, I had did NOT encrypt my files, or permanently delete them):
Prevention:
1. Keep Java up-to-date (if you need it at all). If you don't know what Java is, or don't use it, GET RID OF JAVA! Uninstall it. Most people don't need it anymore—just Android developers, mostly.
2. Surf in incognito modes, if you must surf unsavory sites. This may prevent the ransom-ware from getting outside the browser environment. It might not. This one is just a theory.
3. Use Webroot SecureAnywhere (Anti-virus). Ransomware behaves differently than a virus. Webroot SecureAnywhere (Antivirus) claims that because of the way their software runs "in the cloud", they are the only software capable of "predicting" CryptoLocker patterns. That said, I was using Webroot Secure Anywhere 2011 in 2012, at the time I got hit. Perhaps I'm a glutton for punishment, but I still believe Webroot is the best option (though not perfect). I still use Secure Anywhere, and haven't been hit in over 2 years since.
Removal:
First, I agree with everyone who has espoused good backup habits. I agree. I actually CLONE my hard drive, rather than traditional "backups". That way, if everything crashes, I just have to swap out the hard drive and I'll be back up and running in less than 5 minutes. Whatever method you use, make sure you know how to restore your data from that backup.
Reboot into SAFE MODE.
1. Run a virus scan. In my case, Webroot still detected no virus (so much for my praise above; but I still use them).
2. Now install Malware Bytes Free version (still in SAFE MODE) and run a scan. I don't remember if Malwarebytes found anything or not. It's a second line of defense. A second opinion, if you will.
3. Now run ComboFix from BleepingComputer.net. Whether either of the first two scans detected anything, ComboFix will. Use it as a last resort. It's powerful and takes no prisoners—including the possibility of killing some of your valid programs. In addition to killing the ransomware, it also took out a handy Windows macro program I found very useful. I wish I could remember the name of that program. It's GONE now! Oh well.
When you reboot into normal Windows, now the Ransomware is gone (in my case). I don't know what variant I had. I don't know if it was CryptoLocker or not. But I'm confident that if it ever happens again, I'll have what I need to deal with it quickly and move on.