Data Protection Issues

How to Remove Trojan-Related Content from a OneNote Notebook

WPS Editor Oct 1, 2026 869 views

Question details

The user needs to safely remove Trojan-related content triggering an antivirus alert in a OneNote notebook without losing unsynchronized notes.

How to Remove Trojan-Related Content from a OneNote Notebook

Product: Microsoft OneNote
Device & OS: Windows
Scenario: Resolving a persistent antivirus threat alert linked to a specific OneNote section or cache folder.
Observed behavior: An antivirus program flags a OneNote section or cache file as dangerous due to a suspicious link, embedded file, or attachment.

Before you start

Ensure all your OneNote notebooks are fully synchronized to the cloud before attempting any fixes, as unsynchronized notes will be permanently lost if you clear the cache.

Solution 1Recommended

Inspect and Remove Suspicious Note Elements

Manually identify and delete the malicious links or embedded attachments triggering the antivirus.

Antivirus alerts in OneNote are often caused by embedded malicious files or suspicious links pasted into a page. Removing the specific element usually resolves the threat without risking data loss.

Synchronize your notebook

Open OneNote, right-click the affected notebook, and select 'Sync This Notebook Now' to back up all safe content.

Locate the flagged section

Navigate to the specific notebook section that your antivirus software identified in its threat log.

Delete suspicious elements

Look for unknown embedded files, unexpected attachments, or suspicious hyperlinks. Right-click the suspicious element and select 'Delete' to remove it from the page.

Empty the Notebook Recycle Bin

Go to the 'History' tab, click 'Notebook Recycle Bin', and select 'Empty Recycle Bin' to permanently delete the malicious content.

Run an antivirus scan

Perform a full system scan with your updated antivirus software to ensure the threat is completely removed.

Inspect and Remove Suspicious Note Elements

Check OneNote for the Web: You can also log into OneNote for the Web to verify if the suspicious content has been successfully removed from the cloud version of your notebook.

Solution 2

Clear the OneNote Local Cache

If the antivirus alert persists after deleting the content, the malicious file might be stuck in the local cache directory.

Free Microsoft Office alternative

Try WPS Office for Secure and Lightweight Document Management

If you are experiencing ongoing security alerts, syncing issues, or performance problems with Microsoft Office, consider switching to WPS Office. It provides a secure, lightweight, and highly compatible alternative for managing your daily tasks.

1. Download the software: Visit the official WPS Office website to download the free installation package.
2. Install and launch: Follow the on-screen instructions to install WPS Office, then launch the application.
3. Import and work securely: Open your existing Microsoft Office files directly in WPS Office and enjoy a secure, seamless editing experience.

Free and lightweight office suite with a clean, intuitive interfaceHighly compatible with Microsoft Office formats (Word, Excel, PowerPoint)Built-in PDF tools for secure document sharing and editingReliable cloud sync capabilities with advanced data protection

microsoft office alternative - wps office

Frequently Asked Questions

How do I know which OneNote section is causing the antivirus alert?

You can identify the problematic section by checking the quarantine or threat history log in your antivirus software. The log will usually display the file path, which often includes the name of the specific notebook or section where the threat was detected.

Will clearing the OneNote cache delete my notebooks?

Clearing the cache will not delete notebooks that are safely stored and synchronized on OneDrive. However, it will permanently erase any offline changes or notes that have not yet synced to the cloud.

Can OneNote files actually contain viruses?

While the OneNote text itself cannot contain a virus, malicious files, scripts, or dangerous hyperlinks can be embedded or attached as objects onto a OneNote page. When these sync to your computer, your antivirus software may flag them.

Should I disable my antivirus to stop the OneNote alerts?

No, you should avoid disabling your security protections. If an alert is triggered, it is highly likely that a malicious file is embedded in your notebook. Disabling the antivirus could allow the Trojan to execute and infect your system.

Microsoft Office Security Issues