Data Protection Issues

How to Investigate and Remove a Possible Trojan in OneDriveTemp

Nimra Malik Oct 16, 2026 869 views

Question details

The user is experiencing repeated antivirus detections indicating a potential Trojan in the OneDriveTemp folder and needs to determine if it is a real threat or a false positive.

How to Investigate a Possible Trojan in the OneDriveTemp Folder

Product: Microsoft OneDrive
Device & OS: not provided
Scenario: Resolving repeated antivirus alerts originating from the OneDriveTemp folder during cloud file synchronization.
Observed behavior: Antivirus software repeatedly flags a file in the OneDriveTemp folder as a Trojan, often causing a synchronization loop or halted downloads.

Before you start

Do not whitelist the flagged file or pause your antivirus protection before fully verifying the threat. Ensure your system's antivirus software is updated to the latest virus definitions.

Solution 1Recommended

Investigate and Verify the Antivirus Detection

Determine whether the flagged file in the OneDriveTemp folder is a genuine threat or a false positive before taking permanent action.

Antivirus programs can sometimes flag legitimate files as malware (a false positive). However, because OneDriveTemp is used for active downloads, a persistent alert often means OneDrive is repeatedly trying to sync a file that your security software blocks.

Identify the stuck file

Click the OneDrive cloud icon in your system tray to open the Activity Center. Review the sync list to identify which specific file is currently downloading or failing to sync.

Analyze the file's digital signature

If you can safely locate the source file, right-click it, select 'Properties', and navigate to the 'Digital Signatures' tab to verify if it is signed by a trusted publisher.

Submit for malware analysis

Upload the flagged file (if quarantined, restore it temporarily to an isolated environment) to a reputable malware-analysis service like VirusTotal, or submit it directly to your antivirus vendor's false-positive portal.

Run a full system scan

Open your primary antivirus software (such as Bitdefender or Windows Defender) and initiate a 'Full System Scan' to ensure no other malicious payloads exist on your computer.

Investigate and Verify the Antivirus Detection

Important Safety Warning: Never execute or open the file during the investigation process. Only inspect its properties or upload it to analysis tools.

Solution 2

Remove Confirmed Malware from OneDrive Online

If the file is confirmed to be malicious, you must delete it directly from the cloud to stop OneDrive from continuously downloading it to your OneDriveTemp folder.

Free Microsoft Office alternative

Switch to WPS Office for a Secure and Seamless Workflow

While troubleshooting complex OneDrive sync issues and potential malware, consider a lightweight and highly compatible alternative to Microsoft Office. WPS Office offers robust document management, built-in security features, and seamless cloud integration without the heavy system overhead.

1. Download WPS Office: Visit the official WPS website and click the free download button for your operating system.
2. Install the application: Run the downloaded installer file and follow the straightforward on-screen instructions.
3. Open your existing files: Launch WPS Office and instantly open your Microsoft Word, Excel, or PowerPoint documents with original formatting preserved.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx) for a seamless transition.Lightweight design ensures fast loading and minimal system resource usage.Built-in document encryption features for enhanced data protection against unauthorized access.Includes reliable WPS Cloud storage for secure, conflict-free file synchronization.

microsoft office alternative - wps office

Frequently Asked Questions

What exactly is the OneDriveTemp folder?

The OneDriveTemp folder is a hidden system directory created by Microsoft OneDrive. It is used to temporarily cache data while files are being downloaded or synced from your cloud storage to your local hard drive.

Why does my antivirus keep alerting me about the same file in OneDriveTemp?

If a file in your cloud storage is infected (or is a false positive), OneDrive will attempt to download it. Your antivirus detects and deletes it from OneDriveTemp, but because it is missing locally, OneDrive immediately tries to download it again, creating an endless alert loop.

Should I exclude the OneDriveTemp folder from my antivirus scans?

No, excluding the OneDriveTemp folder is highly discouraged. Doing so creates a security blind spot, potentially allowing real malware to bypass your defenses, download completely, and execute on your system. Always verify and resolve individual file issues instead.

How can I tell if an antivirus detection is a false positive?

You can verify a false positive by checking the file's digital signature to see if it belongs to a trusted publisher, or by uploading the file to a multi-engine scanning website like VirusTotal to see if other reputable security vendors also flag it as malicious.

Microsoft Office Security Issues