@Andy Ful
Yes and no....
If he have sync folder with one drive and is inside shadow defender/ malware can get access to modify copy of it in cloud.. but not your files on disk so you can restart system which will wipe infection and you can sync again same files not touched to re-upload them ^^
...
All depends on what you choose to synchronize. For example, you can be infected by the malware that infects all your documents. If you store documents online (including the new documents) because you do not want to commit them in Shadowdefender, then you can be infected after the reboot. There are many scenarios available.
If you think about automatical infection after reboot, that is very improbable in the home environment. But, it is often possible in the targetted attacks via exploiting the firmware of peripherals (sound card, graphics card, printer, network adapter, router, etc.).