English | Deutsch

What is volsnap?

Volsnap.sys is a Windows driver. A driver is a small software program that allows your computer to communicate with hardware or connected devices. This means that a driver has direct access to the internals of the OS, hardware etc.
The free file information forum can help you determine if volsnap.sys belonging to the Windows system or an application you can trust.

Run a free scan to check for volsnap drivers in need of updating

Volsnap.sys file information

The process known as Volume Shadow Copy Driver or VolSnap belongs to software Microsoft Windows Operating System by Microsoft (www.microsoft.com).

Description: The original volsnap.sys is an important part of Windows and rarely causes problems. volsnap.sys is located in the folder C:\Windows\System32\drivers. Known file sizes on Windows 7/XP are 52,352 bytes (64% of all occurrences), 53,760 bytes and 8 more variants. http://www.file.net/process/volsnap.sys.html 
The driver can be started or stopped from Services in the Control Panel or by other programs. The volsnap.sys file is a Windows system file. The program is not visible. The service has no detailed description. The volsnap.sys file is a Microsoft signed file. volsnap.sys seems to be a compressed file. Therefore the technical security rating is 1% dangerous, however also read the users reviews.
If you have any problems with volsnap.sys, you can do the following:

  • contact www.microsoft.com to assist you
  • completely remove Microsoft Windows (Control Panel⇒Add/Remove programs)

Recommended: Identify volsnap.sys related errors

Important: Some malware camouflages itself as volsnap.sys, for example TROJ_TDSS.BLZ (detected by TrendMicro), and Virus:Win32/Alureon.K (detected by Microsoft). Therefore, you should check the volsnap.sys process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

Its Shadow volume copy, required for NT backup procedure
  Egor Shokurov  
came on in blue screen
Once it is corrupted, this no booting into windows.
  kevin   (further information)
It's when you use a portable hard drive that attaches to your USB port. ie Sage 30 gigabyte. Iam using one now.
  David Hunt  
Volume Shadow Copy driver, an important part of Windows NT based systems (NT, 2000, XP, Server 2000, Server 2003). Sometimes comes up on BSOD's, copying the file from another computer usually solves this.
it was listed as a driver for opening a card reader i plugged into the USB
  mike rae  
Volsnap.sys is an essential part of Windows O/S Volsnapp.sys otoh, is NOT! Volsnapp.sys is a Rootkit.DLL file and should be removed/disabled.
  M. Louis Moore   (further information)
keeps showing up as a rootkit, is a binary file. going to try adding a digit to the file to make it harmless I hope
it can corrupt one of the partitions on dell computers
  terry peterson  
startup repair said "Root cause found: Boot critical file d:\windows\system32\drivers\volsnap.sys is corrupt" Repair action:File repair Result:Completed successfully. Error code=0x0 for Windows 7
laptop would get 0x0000007f (0x00000000...) error on boot right as the GUI screen started up. Copied VolSnap.sys from an XP Sp3 machine to an XP Sp2 machine, rebooted, and all is good
Boot intot he system using OS disk, do a repair and replace the file from the OS disk i386 Directory...Problem fixed
This popped up in a blue screen on Win 7 64 when I was transferring from USB card reader and from USB Hard Drive simultaneously, onto my computer's hard drive.
Volsnap is a key part of Windows backup and restore facility. It is certainly NOT a rootkit.
  Jeff   (further information)
Combofix found with rootkit virus
  Doug B  
kept on rebooting
System File needed for booting
VolSnap.sys is indeed important to Windows. However, it is also a target for viruses. If it is corrupted by a virus, you will have to replace it. If you have Windows installation disks, you can copy it from that. But many computers come with Windows preinstalled and the installation stuff is stored in a partition on the hard disk. In this case you are screwed, since any virus that corrupted Volsnap.sys on the hard drive will likely do it to the restore partition. You can try copying it from another computer. Sometimes this works, sometimes it doesn't.
It is a system vital process, but the TDSS 3-4 rootkits corrupt this file, which causes many things. It it not anything bad. It's bad, in a way, when it's corrupted by TLD3 and 4. See bleepingcomputer.com/forums/forums22.html for instances of this; TDSS Killer is helpful for removing this rootkit causing corruption to VolSnap.sys
  Ellie   (further information)
volsnap on vista is NOT 52k is 227,896 erroroccurs on boot and identifies volsnap replacement of file works rename your current bad volsnap 1st just in case
  Edward Austin  
A virus
  Jim Bob  

Rating chart

Summary: Average user rating of volsnap.sys: based on 22 votes with 21 user comments.
15 users think volsnap.sys is essential for Windows or an installed application. 3 users think it's probably harmless. 3 users suspect danger. One user thinks volsnap.sys is dangerous and recommend removing it. 2 users don't grade volsnap.sys ("not sure about it").

Do you have additional information?
What do you know about volsnap.sys: 
How do you rate it: 
Link for more info's: 
Your Name: 

Volsnap scanner

Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.

Other processes

volsnap.sys [all]