PanicStation.org
UK USA
us Technology & digital loss

What to do if…
a shared folder suddenly appears on your computer and starts syncing unknown files

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Pause or quit the sync app, or disconnect the computer from the internet if you cannot find the control quickly. Do not open the files. Confirm which cloud service and account are involved before changing or deleting anything; if account access looks suspicious, secure the account from a different trusted device.

Do not do these things

  • Don’t open the unknown files to investigate, especially installers, shortcuts, or documents asking you to enable macros or run code.
  • Don’t move, copy, rename, or delete the unknown files while syncing is active. This may create additional synced copies or changes.
  • Don’t select options such as “keep on this device” or “always available offline” for unknown items.
  • Don’t use links in unexpected emails or texts to investigate the folder. Open the official app or type the cloud service address yourself.
  • Don’t wipe or reinstall the computer as a first response unless trusted IT or security support directs you to do so.

What to do now

  1. Stop new syncing.

    • Pause syncing or quit the cloud sync app.
    • If you cannot find the app control quickly, turn off Wi-Fi or unplug the Ethernet cable.
    • Leave the computer disconnected while you identify the service if files are still appearing or changing.

  2. Record the basic details without opening the files.

    • Note the folder name, folder location, cloud service name, signed-in account email, and the approximate time the folder appeared.
    • Take a screenshot of the folder location and the sync app window if this can be done without opening any unknown file.
    • If this is a work or school device or account, contact your IT or security team and send those details.

  3. Use the sync app settings to stop the affected sync.

    • OneDrive: keep sync paused, choose which folders sync, or unlink the computer if the wrong account is attached.
    • SharePoint library synced through OneDrive: use the OneDrive settings option to stop syncing that library.
    • Dropbox: use selective sync to remove the folder from this computer without deleting the cloud files.
    • Google Drive for desktop: pause syncing. If the wrong account is attached, check before disconnecting it: Google says disconnecting an account removes its offline files.
    • If the correct setting is unclear, keep syncing paused or keep the computer offline until IT support or the service’s official help page confirms the next step.

  4. Check whether the folder was expected.

    • From a trusted device, open the cloud service by typing its official address yourself.
    • Look for sharing, activity, account, or device pages where available.
    • Check whether the folder came from a known person, a work or school account, or an account you did not intend to connect.
    • Do not contact the apparent sender through an unexpected message. Use a contact route you already trust.

  5. Secure the account if unauthorized access is plausible.

    • From a different trusted device, change the password for the affected cloud account.
    • Turn on multi-factor authentication if it is not already enabled.
    • Sign out of other sessions and remove unknown devices where the service offers those controls.
    • If the account is managed by work or school, follow your organization’s IT or security process.

  6. Check the computer before resuming sync.

    • If you opened an unknown file, accepted a prompt, or the computer is behaving unexpectedly, keep it disconnected and contact trusted IT or security support.
    • Before resuming sync, run the computer’s built-in security scan. Update the operating system and security tools when it is safe to reconnect or when IT support advises you to do so.

  7. Use the USA reporting routes if needed.

    • If money was lost or the incident appears to involve cyber-enabled fraud or cybercrime, report it through the FBI Internet Crime Complaint Center.
    • If someone used your personal information for accounts, benefits, taxes, or another form of identity theft, use IdentityTheft.gov.

What can wait

  • You do not need to decide now whether to delete the folder or its files permanently.
  • You do not need to inspect every unknown file.
  • You do not need to reinstall the computer as your first step.
  • You do not need to reply to the person who appears to have shared the folder until you confirm the contact route is genuine.

Important reassurance

A surprise shared folder does not automatically mean the computer or account has been compromised. It may be caused by an accidental share, a second account, a work or school library, or an account issue. Pausing sync and checking the connected account gives you time to work out what happened without creating more changes.

Scope note

These are first steps to stop further syncing, avoid opening unknown files, and collect the details needed for IT support or reporting. Later decisions may need help from a trusted IT or security specialist.

Important note

This is general information only. It is not legal, medical, financial, therapeutic, cybersecurity, or other professional advice. If the folder may involve sensitive work, medical, financial, or personal information, contact the relevant organization’s IT or security team promptly.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us