Windows 10: Microsoft Onedrive storage and ransomware.

I use Onedrive cloud storage (v 2021, build 21.129.0627.0002, 64-bit) through MS 365 to store backups from my Windows 10 PC (v 21H1, build 19043.1110). Only in rare circumstances do I exit Onedrive while my PC is up. I use a good antivirus package and have never been affected by ransomware, only very rarely over many years by software viruses, which have been immediately removed. If my PC were to get infected with ransomware which got past the antivirus protections, and my local files became inaccessible, would the backups on Onedrive be safe, or could they also be affected by the ransomware? TIA for any useful advice.

:)

 

How can my files on onedrive get corrupted by a ransomware attack?

US-CERT Alert (TA13-309A) advises some crypto malware variants have the ability to target, find and encrypt files located within
network drives, shared (mapped network paths), USB drives, external hard drives, and even
files stored on cloud services (cloud storage drives) if they have a drive letter. Although cloud backups typically do not use drive letters, many cloud storage services do not save prior file versions so there’s no way to revert to a clean
file version.

OneDrive is Microsoft's
free data hosting cloud service that allows users to sync files and later access them from a web browser or mobile device. I do not use OneDrive, but from what I understand the source data (like

GoogleDrive) resides locally in the OneDrive folder. If that gets encrypted by ransomware, it will get encrypted in the Cloud service as well since it gets automatically synchronized. However, according to Microsoft, OneDrive
has the capability to restore files affected by ransomware by using Version History or restoring from the OneDrive Recycle Bin...see

OneDrive vs. Ransomware which includes links with instructions for recovering OneDrive-based files using Version History and the OneDrive Recycle Bin.

• How to Deal with Ransomware: How can I remediate a ransomware attack?
• Because Ransomware: OneDrive for Business to Get "Files Restore" Option

 

.DOCM Ransomware

Some more helpful links....

• ID Ransomware
• https://support.emsisoft.com/topic/29386-first-steps-when-dealing-with-ransomware/
• How to remove ransomware the right way: A step-by-step guide (Updated for 2019) | Emsisoft | Security Blog
  

 

Ransomware & OneDrive

Hi folks,

Am I correct in assuming that, should a pc be hit by a ransomware virus and the files are encrypted then files in the local OneDrive directories would be encrypted and these encrypted files would be synchronised with the remote ones rendering both versions
useless? This would equally apply to any other cloud storage.