Share via

Is onedrivepatcher.exe still in my pc?

Nick Chan 0 Reputation points
2026-05-03T16:35:26.8133333+00:00

A couple of days ago, I was watching YouTube when a “Do you want to allow this app to make changes to your computer” window popped up. It was onedrivepatcher.exe

As I was not installing or updating anything, I found it suspicious and did not click on either yes or no. The window disappeared on its own after a while. I assumed that means no access is allowed, please correct me if I’m wrong. 

After a quick google search indicated onedrivepatcher.exe is a malware.

Norton and nordVPN threat protection both failed to catch it. 

Under task manager -

  1. startup app looks normal to me
  2. details, there was strange program with a name which was something like lll:nn:nn:nn (l= letters and n=numbers). I think it started with S as it was close to svchost.exe but I am not sure

In the meantime, Norton was being manually updated which triggered a restart. 

After the restart, the weird program was gone from details. I assumed it was the malware and it was a temp file that was purged with the restart. Assumed is playing a big part here as I’m pretty much a computer idiot. 

  • did Get-ChildItem -Path C:\ -Filter "onedrivepatcher.exe" -Recurse -ErrorAction SilentlyContinue which came back with nothing (I just found out this don’t search for hiddle files smh)
  • task scheduler looks normal
  • no new extension on Edge and Firefox
  • no new account under task manager- users

Did the following scans

  1. Norton Startup scan 
  2. Window defender startup scan (there was no Event ID 1001 file for some reason after I did it 3 times, not sure if it actually finished)
  3. Malwarebytes deep scan
  4. MRT full scan

All came back ok apart from the event id 1001 issue mentioned above

I assumed with all these checks that the malware had not successfully installed/infected my pc but want some professional opinion.

I am making this post as I read a Reddit post saying that it is a DLL sideloading malware and assume compromised and to reinstall Windows

I want some suggestions if it is really necessary to reinstall window as I do not have a recent backup and is it just better to reinstall to be on the safe side? Also, if I do go down this route, will a factory reset enough as I don’t have a usb drive to download window on?

Is there any other check I do to confirm?

Also, just curious, what does onedrivepatcher.exe do?

Thanks in advance

Windows for home | Windows 11 | Security and privacy

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. nobuko c 123.2K Reputation points Independent Advisor
    2026-05-03T18:21:56.27+00:00

    Hello,

    Since multiple security tools have already scanned your system and found nothing else, the chance of an actual infection seems low. There is also a possibility that the UAC prompt you saw was just an advertisement made to look like a real UAC window.

    One thing I’d like to confirm:

    When the UAC prompt appeared, did the background screen turn dark (as it normally does with a genuine UAC prompt).

  2. Q&A Assist
    2026-05-03T16:35:45.19+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    The behavior described matches a likely malware or deceptive software attempt, and the safest assumption is that the system may have been exposed even if no file named onedrivepatcher.exe is currently visible.

    Because malware and deceptive software can hide, rename themselves, or make changes that are not obvious, there is no supported way in the provided context to definitively prove that the system is clean just by checking Task Manager, Task Scheduler, or a few scans.

    When there is a credible suspicion of malware infection and uncertainty about whether it was fully removed, the documented guidance is:

    1. If malware may have made changes that cannot be fully reversed, reset or reinstall Windows.
    2. Restore personal files only from backups created before the suspected infection and stored externally (for example, in OneDrive with version history), not from backups that were present on the machine during the infection.
    3. After reinstall/reset, immediately update Windows and all applications.

    For this scenario, that means:

    1. Treat the device as potentially compromised.
    2. Plan to reset or reinstall Windows 11:
      • Use the built‑in recovery options (factory reset/“Reset this PC”) as described in the Windows recovery documentation referenced in the context. A full reset that removes apps and settings is the safer option when malware is suspected.
      • A separate USB installer is not strictly required if the built‑in recovery environment works, but any reset that keeps personal files still carries some risk if malware has modified user data or profiles.
    3. Before resetting:
      • Back up important files to an external location that is known‑good (for example, cloud storage with version history) and avoid backing up executables or installers from the potentially infected system.
    4. After reset/reinstall:
      • Apply all Windows Updates.
      • Ensure Microsoft Defender Antivirus or another reputable antimalware solution is active and fully updated.
      • Reinstall applications only from trusted, official sources.

    If malware has caused irreversible or uncertain changes, the context explicitly recommends reset/restore/reinstall as the remediation path rather than trying to chase individual suspicious processes.

    The context does not provide specific information on what onedrivepatcher.exe does, so no supported description of that executable’s behavior can be given here.

    References:

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.