The Sophos Virus Removal Tool is able to identify and remove malware from a single Windows endpoint computer (Windows XP SP2 and above, for Macs see Mac Home Edition). The tool comes with the latest identities included, to stay current with the latest detections the tool should be downloaded again when a new scan is required.
This article provides an overview of the tool. As it is a free tool, post any questions to our community as there is no phone or email support. If you would like to see more information added to the article please use the feedback box at the bottom of the article.
Applies to the following Sophos product(s) and version(s)
Sophos Virus Removal Tool
Windows XP SP2 and above.
Who should use the tool
The tool is available to both Sophos and non-Sophos customers alike.
Sophos customers are strongly advised to use the latest version of Sophos Anti-Virus in preference to this tool. The Sophos Virus Removal Tool offers no additional detection ability over that of Sophos Anti-Virus version 10. A managed installation of Sophos Anti-Virus however, offers additional benefits like real time scanning and central management.
If you need any assistance with using this tool post your question to the free tools forum.
What the tool does
The tool is a self contained on-demand malware scanner with the following features:
- Automatic updating before a scan
- Scans all connected drives
- Rootkit scanning
- User memory scanning
- Kernel memory scanning
Note: It does not have an on-access scanner (i.e., the ability to scan files real time). Updating is only available in the 2.2 version of the tool.
Where to obtain the tool
You can download the tool from the link below.
- You should always use the latest copy of the tool.
- As the tool cannot self-update or be manually updated you must re-download the tool to receive the latest protection.
Download: Virus Removal Tool - Free virus detection and removal.
This tool is only available for Windows:
- Windows XP SP2 and up
- At least 128MB of RAM
- 80MB of disk space
Using the tool
The tool can be used in two ways:
- Run via the Graphical User Interface (GUI).
- Run via the Command Line Interface (CLI).
1. Running via the GUI
- Launch the tool from the Start Menu by going to: Programs | Sophos | Sophos Virus Removal Tool | Sophos Virus Removal Tool
- Click 'Start scanning'. The Sophos Virus Removal Tool will scan the system and attempt to cleanup any threats that are detected.
2. Running from the Command Line
Note: We recommend whenever possible you use the graphical version of the tool.
The command line tool can be found in the following folder:
- 32-bit computer:
C:\Program Files\Sophos\Sophos Virus Removal Tool\SVRTcli.exe
- 64-bit computer:
C:\Program Files (x86)\Sophos\Sophos Virus Removal Tool\SVRTcli.exe
There are several command line options that can be passed to the command line tool. These are:
|Option ||Description |
|Display extra logging information. |
|Display this text help. |
|Do not do disinfection/cleanup. |
|Reboot automatically if required for cleanup. |
|Remove any pending cleanup on reboot operations. |
|Uninstall after scan and cleanup is complete. |
|Do not ask for confirmation before cleanup. |
I have a question or problem regarding the tool...
Note: If you need any assistance with using this tool you must post your question to the free tool forum. If you are a licensed Sophos customer you are welcome to use the tool (though we recommend you use Sophos Anti-Virus or SAV32CLI). However all support requests should be posted on the same free tool forum as non-Sophos customers.
When posting to the forum you may want to include the log of the scan, or an extract. The log is available from:
- Vista and above:
C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log
C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log