Ransomware is malware designed to block access to files, commonly by encrypting or otherwise changing them until the attacker demands payment. [R1]
If files suddenly have unfamiliar extensions, no longer open, or many files changed at roughly the same time, do not start by restoring copies over them.
The most important rule is:
Clean the infected device before restoring good files.
Remove the active threat first
Microsoft's OneDrive ransomware-recovery workflow deliberately separates recovery into three stages:
- identify affected files;
- clean all devices that use OneDrive;
- restore the files. [R1]
Microsoft warns that restoring files before infected devices are cleaned can result in the restored files being encrypted again. [R1]
Use Windows Security → Virus & threat protection to review detected threats and run an appropriate scan. Windows Security provides quick, full, custom, and Microsoft Defender Offline scans. [R2]
If malware keeps returning or appears able to hide while Windows is running, Microsoft recommends Microsoft Defender Offline, which scans after a restart outside the normal Windows environment. [R3]
Do not restore from an infected state
A backup is useful only if the copy itself predates the infection.
Microsoft recommends restoring files, where possible, from backups created before the infection and stored in an external location such as OneDrive with version history. [R3]
Do not assume the newest backup is automatically safe if ransomware had already started changing files when that backup or synchronization occurred.
Keep the damaged files until you have confirmed that a clean replacement exists. They may still be useful for later investigation or recovery.
Check OneDrive recovery
If affected files were synchronized with OneDrive, Microsoft provides several recovery paths.
The OneDrive ransomware workflow can identify suspicious changes and guide you through cleaning devices before restoring cloud data. [R1]
For individual files, Version History can restore an earlier clean version.
Deleted files may still be available in the OneDrive recycle bin.
For broader damage, eligible Microsoft 365 subscribers can use Restore your OneDrive to undo file and folder changes from within the previous 30 days. Microsoft specifically states that this can restore files that were deleted, overwritten, corrupted, or infected by malware. [R4]
Choose a restore point from before the malicious changes began.
What if the files were only stored locally?
Check any backup that was disconnected or otherwise protected from the infected computer during the attack.
Do not reconnect and restore that backup until the PC has been cleaned or reset.
If malware made irreversible changes to Windows itself, Microsoft notes that resetting or reinstalling the PC may be necessary, followed by restoring data from backup. [R3]
For files that have been encrypted or structurally damaged and have no clean backup or version history, ordinary file-repair or deleted-file recovery tools may not be able to reconstruct the original contents.
Should I pay the ransom?
Microsoft advises against paying.
Payment does not guarantee that access to the PC or files will be restored. [R5]
Preserving backups, cleaning the compromised systems, and restoring known-good copies is the safer recovery path.
What should I do now?
- Stop normal work on the affected device.
- Use Windows Security to identify and remove the active threat.
- Use Microsoft Defender Offline if malware persists or may be hiding.
- Do not restore files until the affected devices are clean.
- Recover from a backup made before the infection.
- Check OneDrive Version History, the recycle bin, or Restore your OneDrive where available.
- Verify restored files before deleting damaged copies.
- If Windows itself cannot be trusted after cleanup, consider reset or reinstall before restoring data.
The goal is not merely to recover a file once. It is to restore clean data into an environment that will not immediately damage it again.