Sophos

Online support

Product maintenance

Contact support

Support services

Removing malicious files with SAV32CLI

After disinfecting infected files with SAV32CLI on Windows NT/2000/XP/2003/Vista, Sophos Anti-Virus may be unable to delete some files because they are held open by the operating system.

Note: Please read Scanning options with SAV32CLI for more information about the other options you can use when running SAV32CLI.

What to do

1. Back up important data

If the infected computer has valuable data on it, back up the data to CD or DVD or a USB device before removing any malicious software. The infection might deteriorate to a point where you could no longer access the operating system, or you might damage the computer during disinfection.

2. Remove the computer from the network

Unplug the network cable or internet device from the computer.

3. Prepare the files necessary to run SAV32CLI

Move to an uninfected Windows computer, and do as follows:

  1. Download an emergency copy of SAV32CLI.
  2. Download the latest virus identity (IDE) files.
    • If the infected computer is running Windows NT/2000, download the self-extracting executable file.
    • If the infected computer is running Windows XP/2003/Vista, download the zip file.
  3. If you downloaded the zip file, double-click the downloaded file to extract the contents into a SAV32CLI folder.
  4. Copy SAV32CLI.exe and the *_ide.exe file or the SAV32CLI folder to a medium that can be write-protected (the example here uses a CD - be sure to close the session once you've written the CD).

Note: If you do not have access to a CD or DVD rewriter device and Sophos is already installed on the infected machine, please restart the computer in minimal system or safe mode from a command prompt (see Step 4 below) then follow the instructions in step 5. This option is not as secure as running SAV32CLI from a CD-R or DVD-R, as no data can be altered.

4. Using a minimal system or Safe Mode with Command Prompt

Move to the infected computer.

If it is not already running in Safe Mode with Command Prompt, switch to that mode now, as follows:

  1. Restart the computer.
  2. After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually. Instead of Windows loading normally, the Advanced Options Menu will appear.
  3. Select the option to run 'Windows in Safe Mode with Command Prompt' and press Enter.
  4. Select your account if it has administrator privileges, or click on Administrator and enter the administrator password.

Now run SAV32CLI as described below.

5. Run SAV32CLI

Place the CD you made in the CD drive (D: in this example).

6. Running SAV32CLI from safe mode

  1. At the command prompt type cd c:\ to access the C: drive.
  2. Type cd program files \sophos\sophos anti-virus to move to the Sophos Anti-Virus program folder.
  3. Type SAV32CLI -REMOVE -P=C:\LOGFILE2.TXT to remove the malicious file(s) and create a log file of the scan in the root of the C: drive.
  4. Press Y when asked if you want to remove the files.

7. Other instructions

Before leaving Safe Mode, edit any registry entries mentioned in the virus analysis recovery instructions. (To open the Registry Editor, type 'regedit'.) Please read the warning about editing the registry.

If problems persist on the infected computer, read the troubleshooting article on removing problem files.

If you need more information or guidance, then please contact technical support.