Trojan in master boot record, please help

Hello weschrist and Matt,

so C: is the OS partition. If D: contains only data Sophos shouldn't choke on D:\System Volume Information\...\*.

But one step at a time. So Sophos Anti-Virus is up to date. You should run SAV32CLI (from the Sophos Anti-Virus directory) with the following settings:

sav32cli.exe -mbr -bs=C,D -all C:\ -p=sav32cli-C.log

This will run quite some time and should detect a threat if there is one. Or you could run a full scan:

sav32cli.exe -mbr -bs=C,D -f -all C:\ -p=sav32cli-C.log

This will take even longer and is usually not necessary. Note that in both cases the scan is restricted to C:.

If it hangs at this point try without the -mbr and -bs options - if it works then this indicates a problem scanning the boot record. Unlikely but who knows.

If you are happy with the results scan your D: drive.

sav32cli.exe -ns -f -all D:\ -p=sav32cli-D.log

If it stops progressing make a note of the last file scanned and stop it using CTRL-C (if it stops the logs should also list where it has been when it has been stopped). Maybe this gives a hint where it "hangs" or seems to hang.

Re: remsav. It is not available for download, you get it from Support. And then only if you have made your case. Doesn't look like a flawed install to me and as long the above checks haven't been done I don't see it's benefit. Anyway it is no longer to be the "big gun" like some previous version as it says: 

Note: This script will attempt to perform a REGULAR uninstall ...

and indeed all it does is calling MSIEXEC /x {ProductCode}.

Christian

Hello weschrist and Matt,

so C: is the OS partition. If D: contains only data Sophos shouldn't choke on D:\System Volume Information\...\*.

But one step at a time. So Sophos Anti-Virus is up to date. You should run SAV32CLI (from the Sophos Anti-Virus directory) with the following settings:

sav32cli.exe -mbr -bs=C,D -all C:\ -p=sav32cli-C.log

This will run quite some time and should detect a threat if there is one. Or you could run a full scan:

sav32cli.exe -mbr -bs=C,D -f -all C:\ -p=sav32cli-C.log

This will take even longer and is usually not necessary. Note that in both cases the scan is restricted to C:.

If it hangs at this point try without the -mbr and -bs options - if it works then this indicates a problem scanning the boot record. Unlikely but who knows.

If you are happy with the results scan your D: drive.

sav32cli.exe -ns -f -all D:\ -p=sav32cli-D.log

If it stops progressing make a note of the last file scanned and stop it using CTRL-C (if it stops the logs should also list where it has been when it has been stopped). Maybe this gives a hint where it "hangs" or seems to hang.

Re: remsav. It is not available for download, you get it from Support. And then only if you have made your case. Doesn't look like a flawed install to me and as long the above checks haven't been done I don't see it's benefit. Anyway it is no longer to be the "big gun" like some previous version as it says: 

Note: This script will attempt to perform a REGULAR uninstall ...

and indeed all it does is calling MSIEXEC /x {ProductCode}.

Christian