Step 1: Confirm your files are infected
Select a file to open it in the online viewer. (This won’t download the file to your device.)
If you don’t see the file, you’ll have the option to download it to your device so can open it.
Repeat steps 1 and 2 for as many files as you want to see.
If your files are infected, select My files are infected to move to the next step in the ransomware recovery process. Otherwise, if your files look fine and you’re confident they aren’t infected with ransomware, select My files are ok.
If you choose My files are ok, you’ll exit the ransomware recovery process and you’ll go back to using OneDrive as usual.
Step 2: Clean all your devices
Step 3: Restore your files from OneDrive