To reiterate snapshot use:
If you have been hit by the worm/virus, make sure you *freeze* you last good snapshot!
Use the:
snap rename <vol-name> from to
to rename something like hourly.1 to PreVirus.
You all know this better than me, I'm sure:-)
beepy