An automated remediation and restoration system comprising: a processor; and computer readable media including instructions which, when executed by the processor, cause the processor to: receive, at a remote cloud service, from a user account associated with a first client device, authorization to enable automated remediation; receive, at the remote cloud service, from the first client device over a communication network during a synchronization session, synchronization data for a first file indicating that the first client device is associated with a likelihood of infection by malware; determine, at the remote cloud service, in response to receiving the synchronization data, that the first client device has been infected by malware; automatically invoke an antivirus service for remediation of the first client device in response to the determination that the first client device has been infected, the first client device being registered with the antivirus service and the antivirus service being locally installed on the first client device; confirm, at the remote cloud service, that the remediation of the first client device has successfully concluded; determine an initial infection time, based on a review of a synchronization history of the first file, when an infected version of the first file was initially submitted for synchronization with the remote cloud service; and automatically restore the first file on the first client device by identifying, at the remote cloud service, a first version of the first file synced prior to the initial infection time and replacing the infected version with the first version, wherein the authorization to enable automated remediation is obtained prior to receiving the synchronization data for the first file. a processor; and computer readable media including instructions which, when executed by the processor, cause the processor to: receive, at a remote cloud service, from a user account associated with a first client device, authorization to enable automated remediation; receive, at the remote cloud service, from the first client device over a communication network during a synchronization session, synchronization data for a first file indicating that the first client device is associated with a likelihood of infection by malware; determine, at the remote cloud service, in response to receiving the synchronization data, that the first client device has been infected by malware; automatically invoke an antivirus service for remediation of the first client device in response to the determination that the first client device has been infected, the first client device being registered with the antivirus service and the antivirus service being locally installed on the first client device; confirm, at the remote cloud service, that the remediation of the first client device has successfully concluded; determine an initial infection time, based on a review of a synchronization history of the first file, when an infected version of the first file was initially submitted for synchronization with the remote cloud service; and automatically restore the first file on the first client device by identifying, at the remote cloud service, a first version of the first file synced prior to the initial infection time and replacing the infected version with the first version, wherein the authorization to enable automated remediation is obtained prior to receiving the synchronization data for the first file. receive, at a remote cloud service, from a user account associated with a first client device, authorization to enable automated remediation; receive, at the remote cloud service, from the first client device over a communication network during a synchronization session, synchronization data for a first file indicating that the first client device is associated with a likelihood of infection by malware; determine, at the remote cloud service, in response to receiving the synchronization data, that the first client device has been infected by malware; automatically invoke an antivirus service for remediation of the first client device in response to the determination that the first client device has been infected, the first client device being registered with the antivirus service and the antivirus service being locally installed on the first client device; confirm, at the remote cloud service, that the remediation of the first client device has successfully concluded; determine an initial infection time, based on a review of a synchronization history of the first file, when an infected version of the first file was initially submitted for synchronization with the remote cloud service; and automatically restore the first file on the first client device by identifying, at the remote cloud service, a first version of the first file synced prior to the initial infection time and replacing the infected version with the first version, wherein the authorization to enable automated remediation is obtained prior to receiving the synchronization data for the first file.