Newbie question: Any need to boot from CD for a "clean" scan?

Peter, thank you; this is a set of extremely good questions.

Because Macs use EFI instead of a BIOS and Master Boot Record, all those boot sector viruses will not work on a Mac.  So far, there have been no EFI-style infectors written, likely due to the security architecture designed into the EFI framework itself.

There are also no currently known rootkits in the wild, so the standard initial scan procedure is just to perform a full system scan.  Once the professional malware authors get to understand the intricacies of the HFS+ partitioning system, we may see more linux-style rootkits show up, but not right now.

Because of the way the operating system and filesystem work, Sophos is unlikely to be unable to access a file due to it's being "in use" -- the malware would have to be loaded by the kernel before Sophos in order to block it from looking at files, as Sophos uses the same filesystem events that are used by the filesystem manager itself.  In essence, Sophos gets to look at the files before other processes start   If your machine is compromised enough that malicious software has loaded something prior to this point, your best bet is to scrub the entire system, preserving only your own user folder, and start again from scratch.

If you do want to step outside of your normal operating environment, keep an emergency hard disk around -- it could be another Mac that you can connect via Firewire, a USB disk, or even a large USB key.  Install the OS on it, and install SAV on that.  You'll need a  volume that's at least 8GB (so no CD boots).

Alternatively, if you have another Mac, use a firewire cable to connect the two and mount the suspicious Mac as and external volume and scan the volume.

So in summary, you don't need a "BootCD" at this time, and due to the architecture of the OS and hardware, many of the reasons for needing this on Windows don't exist on OS X... but most of the Unix/Linux dangers also exist on OS X, so it is wise to keep a backup known-clean boot drive around somewhere that you can install SAV onto if needed.  An 8GB USB key would do the job perfectly, although it couldn't be locked.

You can think of EFI as being "Enhanced Open Firmware" -- OF doesn't have as strict a security model, but it is also unlikely that someone's going to write Forth malware for it at this point, so the issue is moot.  If you want to improve security for it, you can password protect your Open Firmware; that will protect you from any theoretical malware.