What to do when a malicious file is found in sharepoint online onedrive or microsoft teams

You've come across a file in SharePoint Online, OneDrive for Business, or Microsoft Teams, but you're unable to open or share it. You can see the file is there, but it's blocked and the file has a warning icon next to it:

Delete the file (recommended)

To protect yourself, your computer, and your organization, the best option is to delete the file. From the OneDrive mobile app, your only option is to delete the file.

1. Select the file you want to delete (on the mobile app, press and hold to select it).

2. Select Delete.

   

   Deleting in the OneDrive mobile app

Download the file (if your organization allows it)

If your organization allows it, you can download the file by viewing your OneDrive in a web browser. You can then clean the file by whatever means your organization recommends.

1. Go to: https://www.office.com/signin, and sign in with the username and password you use with your work or school account.

   Notes: 

   • For Office 365 operated by 21Vianet in China, sign in with your work or school account at https://login.partner.microsoftonline.cn.
     For Office 365 Germany, sign in with your work or school account at https://portal.office.de.

   • Can't sign in? See I forgot the username or password for the account I use with Office.

2. Select OneDrive.

3. Select the file you want to download, and then select Download.

   

Why is a file in SharePoint, OneDrive, or Microsoft Teams blocked?

The file is blocked to help protect you, your computer, and your organization from malware.

Certain safety features are in place in Office 365 such that a malicious file can be identified in SharePoint Online, OneDrive for Business, or Microsoft Teams. If a file in SharePoint, OneDrive, or Microsoft Teams is deemed malicious, that file is blocked so that no one can open it. A blocked file has a marker after its file name, like this:

Although it can be inconvenient for a file to be blocked, getting infected with malware is even worse. Cybercriminals use ransomware, technical support scams, or unwanted software to compromise users and computers. Once cybercriminals get access to user credentials or sensitive information, they can use that information to gain access to more information or other users, or even charge fraudulent fees. To learn more, see Understand the different malware types.

What can I do to avoid running into malicious files in the future?

Although cybercriminals continue to find new ways to trick people with malware, there are steps you can take to help protect you and your computer.

• Run security software on your computer and keep that software up to date. See Help protect my computer with Windows Defender.

• Install the latest software updates on all your devices. See Windows Update: FAQ.

• Use caution with email attachments and files. See How to recognize phishing email messages, links, or phone calls.

To learn more about how malware works and how to prevent malware infection, see Help prevent malware infection on your PC.

What do I do if I think the system made a mistake?

If your organization uses Office 365 Advanced Threat Protection and a file is blocked that you think should not be, you'll need some help from an Office 365 administrator who can research the issue and, potentially, unblock the file. To learn more about what Office 365 administrators do, see About Office 365 admin roles.

Learn more

• Office 365 ATP for SharePoint, OneDrive, and Microsoft Teams

• Protect your account and devices from hackers and malware