Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.



  • Please log in to reply
1 reply to this topic

#1 thecomputerplace0


  • Members
  • 4 posts
  • Local time:09:09 PM

Posted 10 June 2011 - 05:45 PM

Hi All,

We have been cleaning a virus that infects volsnap.sys on some systems. On some of the pcs we get a message stating combofix is attempting to disinfect volsnap.sys or something to that effect and reboots, and volsnap.sys is no longer infected (when we scan it offline the file comes out clean). Some of the pcs combofix doesn't detect volsnap.sys being infected and so therefore won't remove the infection. We've tried a slew of other tools to remove the infected volsnap.sys file (hitman pro, malwarebytes, dr. web, rootkit scanners, etc), but no dice. The only thing that works is to pull the drive and replace the infected file with a known good one. The symptoms are google redirects and 2-3 iexplore.exe processes running in the background. We've successfully cleaned volsnap.sys off probably 10 pc's and had 3 so far that we had to pull the drives and replace it. After we replace volsnap with a known good one, the redirects stop and no more rogue Iexplore.exe processes running. The systems scan clean as well after that with combofix, hitman pro and malwarebytes. Anyone run across this issue and have a fix for the one's that we are having to yank the drives and replace volsnap.sys on? Thank you - hope our problem and solution can help others with similar issues :)

BC AdBot (Login to Remove)


#2 Broni


    The Coolest BC Computer

  • BC Advisor
  • 42,725 posts
  • Gender:Male
  • Location:Daly City, CA
  • Local time:07:09 PM

Posted 10 June 2011 - 06:04 PM

First of all, you shouldn't be running Combofix on your own.

volsnap.sys file is one of the main target of TDL rootkit.
Disinfection and removal requires some guided help.
Playing with volsnap.sys file may make your computer unbootable.

With the information you have provided I believe you will need help from the malware removal team. I would like you to start a new thread and post a DDS log HERE and include a link to this thread. Please make sure that you read the information about getting started before you start your thread.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient. Help is on the way!

My Website


My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users