Respond to a OneDrive ransomware warning before restoring files

A OneDrive ransomware alert can mean synchronized files have been encrypted or renamed by malware on a connected computer. The priority is to stop the source of new damage. Restoring cloud files while an infected device is still syncing may simply encrypt the restored copies again. Microsoft's guided workflow asks you to inspect suspicious files, clean connected devices and only then restore OneDrive.

Before you start​

Use a clean device to reach OneDrive.com directly if possible. Do not trust a link in an unexpected email without verifying the Microsoft account and destination. Preserve a small sample of encrypted filenames and timestamps for incident records, but do not open suspicious executables or pay a ransom.

Do it step by step​

1. Check whether the warning is genuine by signing into the correct OneDrive account yourself. Inspect the suspicious file examples in the web viewer; unexpected extensions, garbled contents or mass renaming are stronger evidence than the alert alone.
2. If the files are compromised, disconnect the suspected computer from the network to stop further synchronization. Identify every device currently connected to that OneDrive account, including work and home PCs.
3. Follow trusted antivirus or organizational incident-response instructions to clean or reset each affected device. A clean cloud restore is not safe while a device continues uploading encrypted versions. Seek professional help for a business device or widespread infection.
4. Change account credentials from a known-clean device if there is evidence of account compromise, and inspect sign-ins and sharing. Malware on a PC and unauthorized cloud account access are related but distinct possibilities.
5. After devices are clean, use Microsoft's OneDrive ransomware recovery flow or Restore your OneDrive to choose a point before the attack. Examine the change timeline rather than accepting an arbitrary date.
6. Review a representative set of restored files, sync status and any files created after the chosen point. Keep affected devices disconnected until confident they will not replay bad changes.

Check the result​

Clean devices are back under control and sample restored documents open normally. The change history no longer shows fresh mass encryption, and important post-restore files are accounted for.

If something goes wrong​

If the web flow does not identify the attack or recovery is unavailable, preserve the account and device evidence and use independent backups or Microsoft support. Do not repeatedly restore into an active infection.

Know the limit​

Detection and restore availability depend on plan and retention. Cloud version history is not an isolated backup; synchronized malware or deletion can exhaust available recovery windows. Keep offline or otherwise independent copies of essential data. Microsoft OneDrive ransomware recovery