When one of your devices makes changes that look like ransomware (ransom notes, ransomware file extensions, files rewritten with random-looking content), its changes are refused, and you get a notification, an e-mail and a banner in the web app. The device can still read your files.
From another device, open the alert (Review in the banner):
- Rewind files to before it puts your files back to the moment of the first suspicious change. Check Show what changes, then start it. Nothing is deleted for good.
- It was me resumes the device if the changes were yours.
- Sign that device out ends that sign-in.
A rewind and It was me ask for a code from your authenticator app. Clean the infected computer (or reinstall it) before you sign in on it again.