Sophos Anti-Rootkit: scan for hidden objects

You can choose which areas to scan for rootkits.

1.	Click the check boxes for the areas you want to scan (all areas are selected by default).

2.	Click the Start scan button or press the Enter key to start the scan for hidden items, in all the selected areas.

Note: On Windows NT4 the Running processes scan is not supported, but you can scan the registry and the disk.


Sophos Anti-Rootkit: scan results

Sophos Anti-Rootkit scans for suspicious items, which you can then remove.

1.	While Sophos Anti-Rootkit is scanning, results are displayed in the top half of this window.

Note: To stop the scan before it has completed, click the Stop scan button.

1.	When Sophos Anti-Rootkit has stopped scanning, a pop-up appears telling you that the scan is complete and reports whether it has found any suspicious items. These items are listed in the top panel.

2.	Click on the name of a suspicious file to display more information about it in the lower panel. The information displayed includes whether the item is recommended for removal. All checked items are recommended for removal. Sometimes the top panel displays a hidden process, registry key or value. When you clean up the rootkit(s), these entries will also disappear.

Note: To return to the Scan for hidden objects dialog box, click the Back button. This will lose the results of the current scan.

1.	Click Clean up checked items or press the Enter key to remove all the selected items.

2.	A popup screen appears informing you the system will need to be restarted to complete the removal procedure. Click Restart now or Restart later at the popup screen.


Sophos Anti-Rootkit: results of cleanup operation

The Results of cleanup operation screen displays files originally selected for removal and the action taken.

To empty the contents of the panel, click Empty list.

To return to the Scan for hidden objects dialog box so that you can re-scan your computer, click Continue

Note: Sophos strongly recommends you re-scan your computer both with the Sophos Anti-Rootkit program to make sure all unauthorized files are removed and then again with anti-virus software such as Sophos Anti-Virus 6.0.