This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Rename command for sav32cli?

I know this forum probably says that I am a new user, but I probably know more than most users of this product. My mother works at Sophos in Vancouver. She's one of the best there, and if it weren't so late and if she didn't have to work tomorrow I'd probably have just phoned her when I got stuck.

My laptop has been having some issues lately... Especially within the last 2 days. Mostly tonight. I figured there might be a latent problem from the last time it blue screened. You see, a few weeks ago, my computer blue screened 4 times in one hour. The only other time it had done this was when I plugged the ethernet cord into it at my grandma's and it balked at it. Seems it prefers wireless, lol. In any case, I ran a normal Sophos scan on it, the "Clean" scan that mom set up that checks everything it can, and ran a windows repair on my laptop. It seemed fine afterwords and didn't blue screen again, until apparently earlier today... Approximately 2:08 PST. I couldn't find anything about it really... Only thing I found was something about my video card. Then I was watching an episode of CSI: NY online, and it caught on the sound track a couple times, but only for a few seconds... Then it did it for about a minute.

When it recovered that time, it had closed both Firefox windows. I tried to click the 'More info' icon, but nothing happened. I tried to check the event log, start Sophos Anti-Virus scan, etc. Nothing worked, then my laptop screen started flashing, like a smashed in TV screen that was turned on. While it was doing that I caught a glimpse of the blue screen of death just before it blacked out and then restarted.

I decided it was time to do what Mom had suggested the last time I'd asked about it, because it appeared to be the same problem... I couldn't tell for sure because I didn't catch the information on the blue screen however. Couldn't hurt to follow my mom's advice.

I downloaded, installed and am running the Sophos Anti-root kit, as well as conducting a scan. I'm going to send my mom my mini-dump files. She also said to find the exact location of sav32cli.exe and run it through command prompt. The line of code she gave me was: sav32CLI -f -all -pua -di -remove -p=c:/logfile.txt

The same line of code that I've used a few times before on my brother and sister's computer. Then she thought about it and said to check the sophos site and see if there was a rename option with sav32cli. She said this so that if it was something Sophos hadn't seen before, they could analyze it. You see, a few weeks ago when I ran that clean scan, it turned up with nothing. Absolutely nothing. Not even a suspicious file like it normally comes up with. It didn't even repost the 2 it keeps in quarantine that I can't do anything to, and it normally does repost them.

So, my question is: Is there a rename command? Making the line of code, for example: sav32CLI -f -all -pua -di -rename -p=c:/logfile.txt (rename instead of remove) And I'm sorry if you would have prefered I left the story of what was going on with my laptop out, but I figured, just incase, the background to the problem would be a good idea while it was still fresh in my mind.

:1288


This thread was automatically locked due to age.
  • Help is your friend.....:smileyhappy:

    sav32cli --help

    Usage: sweep [options] <path1> <path2>... <pathN> [include/exclude options]

      where <path1>, <path2>... <pathN> may refer to files, directories or

      filesystems.

      Note: With the exception of the -include and -exclude options, it does not

      matter where on the command line you specify an option: you can specify it

      before, in the middle of, or after, a list of paths. Regardless of where it

      appears, it is applied to all the paths on the command line. However, the

      -exclude and -include options control whether the paths after them are

      scanned, and therefore the position of these options does matter. If you

      specify options which have opposing effects to each other (for example,

      -archive followed by -narchive), then the latest one on the line takes effect

      (in this example, -narchive would take effect).

    The following options may be prefixed with 'n' to invert their meaning

    (for example, '-nsc' is the inverse of '-sc'). [*] indicates the option

    is the default:

      -sc         [*] : Scan dynamically compressed executables

      -f          [ ] : Full scan

      -extensive  [ ] : Scan complete contents of files

      -di         [ ] : Disinfect infected items

      -s          [*] : Run silently (do not list files swept)

      -c          [*] : Ask for confirmation before disinfection/deletion

      -b          [*] : Sound bell on virus detection

      -all        [ ] : Scan all files

      -rec        [*] : Do recursive scan

      -remove     [ ] : Remove infected objects

      -dn         [ ] : Display file names as they are scanned

      -ss         [ ] : Don't display anything except on error or virus

      -eec        [ ] : Use extended error codes

      -ext=extension,..     : Specify additional extensions to SWEEP

      -p=<file>       : Write to logfile <file> in default encoding

      -putf8=<file>   : Write to Unicode UTF-8 logfile <file>

      -putf16=<file>  : Write to Unicode UTF-16LE logfile <file>

                        (only one of -p/-putf8/-putf16 may be specified)

      -idedir=<directory>   : Read IDEs from alternative directory

      -exclude        : Exclude the following objects from scanning

      -include        : Include the following objects in scanning

                        (use after -exclude)

      -v              : Display complete version information

      -vv             : Display complete version information and details on

                        extensions and archive types supported

      -h              : Display this help and exit

    The following options are related to archives and other special file types:

      -zip        [ ] : Scan inside ZIP archives

      -gzip       [ ] : Scan inside GZIP compressed files

      -arj        [ ] : Scan inside ARJ archives

      -cmz        [ ] : Scan inside Unix-compressed files

      -tar        [ ] : Scan inside TAR archives

      -rar        [ ] : Scan inside RAR archives

      -archive    [ ] : All of the above

      -cab        [ ] : Scan inside Microsoft Cabinet files

      -loopback   [ ] : Scan inside loopback-type files

      -mime       [ ] : Scan files encoded in MIME format

      -oe         [ ] : Scan Microsoft Outlook Express mailbox files

                        (requires -mime)

      -tnef       [ ] : Scan inside TNEF files

      -pua        [ ] : Scan for adware/PUAs

      -suspicious [ ] : Scan for suspicious files

    The following options may be prefixed with 'no-' to invert their meaning

    (for example, '--no-reset-atime' is the inverse of '--reset-atime'.  [*]

    indicates the option is the default:

      --reset-atime          [*] : Reset file access time after scanning

      --stop-scan            [*] : Abort scanning of files such as 'zip bombs'

                                   which require excessive amounts of time,

                                   disk space or memory to scan

      --ignore-could-not-open[ ] : If a file cannot be opened, don't treat it as

                                   an error

      --vdb-integrity-check  [ ] : Virus data integrity checking.

      --vdb-integrity-info   [ ] : Print out virus data integrity information.

                                   (Only if --vdb-integrity-check is also set.)

      --show-file-details    [ ] : Show file ownership and permissions when

                                   displaying filenames

      -move=<quarantine directory>

                             [ ] : Move infected files to a quarantine directory

      -rename                [ ] : Append filename extension 'infected' to names of

                                   infected files (unless they already have this

                                   extension)

      -cleanup               [ ] : Cleanup detected malware (setting this option

                                   also enables -di and -pua)

    The following options are Windows-specific, and may be prefixed with 'n'

    to invert their meaning (for example, '-nmbr' is the inverse of '-mbr').

      -mbr        [ ] : Scan master boot records on all hard disks

      -bs=X,...   [ ] : Scan boot sector of each drive listed

      -mac        [ ] : Scan for Macintosh viruses

      -cdr=X,...  [ ] : Scan boot sector in bootable image of each CD drive listed

    So yes, there is a rename option.

    :48206