PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
a shared folder suddenly appears on your computer and starts syncing unknown files

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Pause or quit the sync app first, or disconnect from the internet if it will not stop. Then identify which cloud account and service created the folder before opening, moving, deleting, or copying any of the unknown files.

Do not do these things

  • Don’t open unknown files to see what they are, especially shortcuts, installers, compressed files, or documents asking you to enable macros or content.
  • Don’t drag the folder somewhere else, rename it repeatedly, or tidy it up while it is still syncing.
  • Don’t copy the unknown files into another folder, USB drive, chat, email, or cloud service.
  • Don’t click links in unexpected “shared folder” emails or messages to verify access.
  • Don’t sign out of every account in a panic before noting which account and service are involved.
  • Don’t delete the folder from the cloud web page unless you are sure it is only your copy and not a shared work or family location.

What to do now

  1. Stop the syncing so nothing else downloads.

    • Click the sync app icon in the taskbar or menu bar, such as OneDrive, Dropbox, Google Drive, iCloud Drive, or another work sync tool.
    • Use Pause syncing, Quit, Stop sync, or the closest option shown by that app.
    • If the sync will not pause, turn off Wi-Fi or unplug Ethernet.

  2. Write down what you can see without opening the files.

    • Note the folder name, folder path, cloud service name, account email, time you noticed it, and any company or organisation name shown.
    • Take screenshots of the sync app window, the folder path, and any warning or sharing message.
    • Do not open the unknown files for screenshots.

  3. Identify the account and service that created the folder.

    • Open the sync app’s settings, preferences, or account screen.
    • Check the signed-in email address and whether it is a personal, work, school, or organisation account.
    • Look for synced folders, shared folders, shared libraries, shortcuts, selective sync, or recently added locations.

  4. Stop syncing that specific folder or library if the app allows it.

    • For OneDrive or SharePoint, look for an option such as Stop sync, Choose folders, Remove shortcut, or Unlink this PC.
    • For Google Drive, Dropbox, or another app, look for Pause syncing, Preferences, Selective sync, Quit, or an account disconnect option.
    • Keep the app paused until you understand whether the folder is legitimate.

  5. Check how it may have been added without clicking unexpected links.

    • Search your email and deleted items for terms such as “shared”, “invited”, “OneDrive”, “SharePoint”, “Dropbox”, “Google Drive”, and the folder name.
    • In a browser, type the cloud service address yourself or use a saved app, rather than using a link from an unexpected message.
    • In the service’s web view, look for areas called Activity, Recent, Shared with me, Sharing, Devices, or Security.

  6. If the folder may be from work or school, contact the administrator.

    • Send your IT or security team the folder name, account email, time it started, screenshots, and whether you opened any files.
    • Ask whether it is a legitimate shared library, a policy change, a mistaken share, or something they want treated as a security incident.
    • Keep syncing paused until they answer.

  7. If you suspect account compromise, secure the account from a different device.

    • Use a phone or another computer you trust.
    • Change the password for the cloud account involved.
    • Turn on two-step verification if it is not already on.
    • Sign out of other sessions and remove devices you do not recognise if the account security page offers that option.

  8. Run a basic safety check before resuming sync.

    • Run your operating system’s built-in security scan.
    • Install pending security updates.
    • If the scan finds anything, or if unknown files keep reappearing after you stop syncing, keep the computer offline and ask trusted IT support for help.

  9. Report fraud or cyber crime if there is loss, identity misuse, hacking, or an attempted scam.

    • If someone is in immediate danger or a crime is happening now, call 999.
    • If you are in England, Wales, or Northern Ireland, report cyber crime or fraud to Report Fraud online or by calling 0300 123 2040.
    • If you are in Scotland, contact Police Scotland on 101 for non-emergencies.

What can wait

  • You do not need to decide right now whether to delete the folder permanently.
  • You do not need to sort, clean up, or organise the downloaded files today.
  • You do not need to confront the person or account that shared it until you know whether it is legitimate.
  • You do not need to reinstall the computer as a first step unless IT or a trusted security professional advises it.
  • You do not need to report it to the police unless there is suspected fraud, cyber crime, identity misuse, money loss, or immediate risk.

Important reassurance

A sudden shared or synced folder can come from a normal change, such as a work SharePoint library, a second account, a shortcut added by mistake, or a mistaken share. Pausing sync, noting the account, and checking before opening files is a calm and reversible way to regain control.

Scope note

These are first steps to stop further syncing, avoid opening risky files, and gather enough information to escalate safely. Later decisions about malware investigation, restoring files, deleting cloud data, or formal incident handling may need help from the cloud provider, workplace IT, or a security professional.

Important note

This is general information, not legal, financial, professional IT, cybersecurity, or incident-response advice. If this involves a work, school, client, or organisation account, follow that organisation’s security process and involve its IT or security team early.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us