Trojan in master boot record, please help

Thanks Christian,

Only problem I see with this is that if the machine is infected and has 'modified' Sophos like a certain rootkit I can think of does, sav32cli will not find or detect it during this scan (even in the MBR). The best option if the user is convinced there's something more on the machine has to be to scan the HD on a known clean and working system, my original thought. Utilising a different vendor's software on a system known to be infected also helps to 'double' check if an external scan is not available hence prevx (almost unknown and extremely small/fast) but pretty reasonable for standalone.

Hadn't realised remsav wasn't available to download. My copy also deletes some registry entries and files/folders as well as running the MSI. Perhaps it's customised by support for individuals?

Matt

Thanks Christian,

Only problem I see with this is that if the machine is infected and has 'modified' Sophos like a certain rootkit I can think of does, sav32cli will not find or detect it during this scan (even in the MBR). The best option if the user is convinced there's something more on the machine has to be to scan the HD on a known clean and working system, my original thought. Utilising a different vendor's software on a system known to be infected also helps to 'double' check if an external scan is not available hence prevx (almost unknown and extremely small/fast) but pretty reasonable for standalone.

Hadn't realised remsav wasn't available to download. My copy also deletes some registry entries and files/folders as well as running the MSI. Perhaps it's customised by support for individuals?

Matt