https://support.microsoft.com/en-us/office/ransomware-detection-and-recovering-your-files-0d90ec50-6bfd-40f4-acc7-b8c12c73637f
Ransomware detection notifies you when your OneDrive files have been attacked and guides you through the process of restoring your files. Ransomware is a type of malicious software (malware) designed to block access to your files until you pay money.
When Microsoft 365 detects a ransomware attack, you'll get a notification on your device and receive an email from Microsoft 365. If you're not a subscriber, your first notification and recovery is free. See available plans.
Click the link in the notification or in the email, or go to the [OneDrive website](<https://go.microsoft.com/fwlink/p/?LinkID=251869>), and we'll walk you through the recovery process, which includes:
If Microsoft 365 detected a ransomware attack, you see the Signs of ransonware detected screen when you go to the OneDrive website (you might need to sign in first). Select the Get started button to begin.
On the Do these files look right? screen, we'll show you some suspicious files. If they have the wrong name or suffix, or don't look right when you open them from the list, they're likely compromised by ransomware.
Select a file to open it in the online viewer. (This won't download the file to your device.)
If you don't see the file, you'll have the option to download it to your device so can open it.
Repeat steps 1 and 2 for as many files as you want to see.
If your files are infected, select **My files are infected** to move to the next step in the ransomware recovery process. Otherwise, if your files look fine and you're confident they aren't infected with ransomware, select **My files are ok**.
If you choose **My files are ok**, you'll exit the ransomware recovery process and you'll go back to using OneDrive as usual.
On the Clean all your devices screen, you'll see instructions for cleaning all your devices where you use OneDrive. Before you restore your files, it's important to use anivirus software to clean all your devices. Otherwise, your files could get encrypted again when you restore them.
Select the link for the version of Windows that you're using and follow the instructions in the article.