User manual SOPHOS ANTI-ROOTKIT 1.5 07-2009

[. . . ] Both versions are installed when you run the installer. The command-line version can be used over a network to remove rootkits. For instructions on how to do this, see http://www. sophos. com/support/knowledgebase/article/17004. html. 2 System requirements Sophos Anti-Rootkit is supported on the following operating systems: Windows 2000 Windows XP Windows Vista Windows 7 Windows Server 2003 Windows Server 2008 64-bit platforms For detailed system requirements, go to the Sophos Anti-Rootkit product page at http://www. sophos. com/products/free-tools/sophos-anti-rootkit. html. [. . . ] Open a command prompt and change to the Sophos Anti-Rootkit installation folder by typing: cd C:\Program Files\Sophos\Sophos Anti-Rootkit 2. To view the command line help, type: sarcli -help For more information on using the command-line version of Sophos Anti-Rootkit, see http://www. sophos. com/support/knowledgebase/article/17091. html. 4 Sophos Anti-Rootkit user manual 7 Start Sophos Anti-Rootkit using the Windows interface Click Start > Programs > Sophos > Sophos Anti-Rootkit > Sophos Anti-Rootkit. 8 Scan for rootkits To scan your computer for rootkits: 1. Select the check boxes next to the areas of your computer that you want to scan. Select the Extensive scan check box to scan every file on your computer during the Local hard drives scan instead of just the hidden ones. Note: Selecting this option will potentially find more rootkits, but the scan will take longer to complete. Depending on your computer, the time taken for this may be over an hour. When the scan is complete, a dialog box is displayed showing whether Sophos Anti-Rootkit has found any suspicious files. 9 Clean up rootkits The names of suspicious files are displayed in the results list in the upper panel of the Sophos Anti-Rootkit window. The results list may also display registry keys or values. These items cannot be marked for removal. However, after you have cleaned up any rootkits, these items will disappear from the results list. 5 Sophos Anti-Rootkit user manual To clean up rootkits: 1. Click the name of a suspicious file or process to display information about it. The information displayed includes whether the item is recommended for removal: Option Removable: No Removable: Yes (clean up recommended) Removable: Yes (but clean up not recommended for this file) Description These files cannot be marked for removal. These files are automatically marked for removal by default. These files are not automatically marked for removal. Sophos does not recognize these files and recommends that youdo not remove them. If you are unsure what to do about some of these files, follow the instructions in Technical Support (page 7) to send the log and archive files to Sophos for further analysis. The information displayed may also tell you whether there is a description of the file. To view the description of the file, go to the Sophos website at www. sophos. com, type the name of the file in the Search box at the top of the home page, and then click the Search button. The checked items are marked for removal and will be cleaned up when you restart your computer. [. . . ] Under File 1, click Browse, and then navigate to the following files in turn: %TEMP%\samples. sar %TEMP%\sarscan. log %TEMP%\sarclean. log samples. sar is an encrypted archive of all hidden files detected by the scan and sarscan. log is a text file listing the hidden files contained in samples. sar. Before you send sarscan. log to technical support, check that it does not contain any confidential information. To view sarscan. log, type the following from either the Windows Run dialog box or the command prompt: %TEMP%\sarscan. log Any submission of files and/or data to Sophos is covered by the Sophos End User License Agreement, which is available at www. sophos. com/legal. 12 Copyright Copyright © 2004-2009 Sophos Group. [. . . ]