BSOD volsnap.sys error and steadily decreasing memory

[nominalismus]

Hi,

Anyways, a few days ago I experienced a blue screen (the reason I'm only posting now is because I originally posted at Tom's Hardware--because I didn't know about these forums--and received no answers). It indicated that the problem was Error 25--volsnap.sys--the text of the error in Event Viewer is as follows:
The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.

My computer is a Lenovo X1 Carbon running Windows 7 Home Premium.

I actually experienced this about a month ago and relocated the backup to an external drive--assuming this is what shadow copies are. Apparently that isn't the case.

Anyways, since undergoing this blue screen, I've run the following checks/scans on all volumes:
-chkdsk (both /f and /r)
-fsutil dirty query
-hard drive scan through wmic (and the built in Lenovo function for checking hard drive health, as well as other components)
-avast! antivirus
-Malwarebytes

All of these have come up clean.

I also tried to run vssadmin shadow storage to check that status out and possibly relocate the diff area--however even when I tried to run the function as an administrator it was blocked by group policy and I have no idea how to change that or if it would even help. Anyways, that's what the Microsoft service thing told me to do when I checked the Event Log Online Help link in Event Viewer. Obviously that didn't come to anything.

For context: the last few days my c: drive has steadily been losing storage space--suddenly jumping down to about 3 GB of space and then getting lower and lower. I ran disk cleanup and went via WinDirStat to locate and remove redundant files. This got me back up to 15 GB at the highest and it continued to trickle down. I didn't notice this last time the volsnap.sys blue screen happened, but I also hadn't checked. This time the Lenovo Solution Center warned me that my storage space was getting really low. I hadn't downloaded any programs or anything in a really long time and backup was going to an external drive.
After I turned the computer on after the blue screen (note that currently everything is functioning perfectly, just like it always has--there's no slowness or anything) I noticed that my available space on the c: drive had jumped up to 46 GB or so. I mean, this makes sense I guess because all the shadow storage copies were deleted--which probably means that it was shadow storage that was taking up so much space. That also means that it filled up just in the last month since the last time this happened--after which I evidently misunderstood and therefore failed to fix the problem. Oops.
In addition--both times this has happened Windows has attempted and failed to install updates the morning preceding the crash.
Another weird coincidence is that both times this occurred while I was simultaneously writing an email (via gmail) and running a MozyHome backup.
(Note--since this occurred a few days ago, the memory has steadily been going down. Currently it is only at 36 GB)

I don't know how much of this information is useful, but I've tried to include absolutely everything I can think of.
Would relocating the Diff Area for Volume Shadow Service be a good solution? If so, how do I actually access this function given that group policy (I'm also not totally sure what this is or means) won't let me do it even as an administrator?
Is there any other solution I'm overlooking?

I'm just really afraid of this happening again while I'm working on something important and losing important data. I'm a grad student and constantly working on papers and lesson plans and proposals, etc. so having a functioning computer is absolutely critical. I save frequently, but sometimes you're just caught off-guard.

Thank you so much anyone reading this for bearing with me for so long. I'm really just trying to be thorough.
Any help is extremely appreciated.
Again--thank you so much!

 

[Laith]

Hello and welcome to Sevenforums!rb:

Do you need Shadow copying?

 

[nominalismus]

Hi!

Thank you so much for replying.

To the best of my knowledge, the computer is making shadow copies (at least I assume that's what is making the memory on my c drive continue to decrease), but honestly I don't know how to tell. My hunch (with the enormous caveat that the very little I know about computers stems from googling and previous troubleshooting for other issues) is that it's something with the way the shadow copies are being made or where they're being located to. I have no idea how to find or move them. The error message also mentioned I/O load and I have no idea how to do anything with that.

But I welcome any tips, shadow copy wise!

 

[Laith]

Shadow copying is basiclly a thing that backups your computer every week if im correct. If you don't need that then i can say how you can disable it and stop the BSODs to occur.

 

[nominalismus]

Ok. Quick question though--is it different than a normal backup? I'm inclined to think it is, just because I run my backups to an external drive, so that couldn't possibly account for the memory decrease. I just want to check though before I do anything.

Thanks!

 

[Laith]

If you backup your files into a external drive then you can disable shadow copying and get rid of the BSODs.


1. Click on Start, type services and press enter.
2. Locate the service "Volume Shadow Copy" and right click and click "Stop".
3. Close Services windows.

 

[nominalismus]

I'll give that a shot and report back on how that goes in terms of decreasing memory.
Thanks!

 

[nominalismus]

Actually--weird thing. I just checked and the service was already stopped. I don't know what that means exactly, especially in terms of this issue and the error 25 report.
I checked event viewer and what's coming up recently is:
event ID 11, with the following text: The driver detected a controller error on \Device\Harddisk1\DR11

I keep trying to open the Event Viewer Online Help link but it won't open--I tell it to send information, but it just doesn't. That's never happened before. I tried another event and that wouldn't come up either.

 

[nominalismus]

Actually--update: the event viewer online help was only slow. In any case, it didn't bring up anything for event 11.

 

[Laith]

A driver? Run Driver Verifier for 24 hours. http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

 

[nominalismus]

Hi,

I just wanted to check back in. It turns out I misunderstood whether VSS was on or off. I stopped it yesterday (actually stopped it this time) and the memory leakage has continued anyways.
Event 11 has come up again (I checked event viewer) but I haven't had time to run the driver verifier. I can't afford the possibility of frequent crashes for a full 24 hours, so running that is sort of freaking me out a little.

 

[Laith]

No, if you run Driver Verifier it will only BSOD when it has found the culprit, if it BSODs on startup then you must disable it by going into safe mode.

 

[nominalismus]

Ok. Good to know. I'll run it in the next couple of days then (also, I'm assuming the computer has to be continually on for those 24 hours? I feel like this is a dumb question, but it can't hurt to ask, I figure).
Also, weird thing--I checked event viewer and I had a volsnap.sys error even though I've stopped the VSS service.

The content of the error message was:
The shadow copies of volume D: were aborted because of an IO failure on volume D:.

I'm guessing it's referring to my external drive D:
At least that sort of makes sense to me. Still, I didn't even know shadow copies would be going there or how that could have gotten set up. That error showing up just seems weird to me.

Again, thank you so much for your help! I really appreciate it!

 

[Laith]

The shadow copies in general is backups that dosent take any space. There's no need then to run Driver Verifier. We knew in the first beginning that it was the shadow volumes in D: that caused it. If you turn off it on D: atleast it should solve the problem.

 

[nominalismus]

That's good to know. I'm hoping that it turns out that way. The only thing is that, even though I've turned off the shadow copy service, I'm still experiencing the memory leak. I have absolutely no idea what could be causing this, especially since I really don't put much of anything on my computer's hard drive--virtually everything goes to an external. It's just weird.

Also, thank you so much again for your help!

 

[Laith]

Hm, run MemTest86+. This might be alot of stuff. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

 

[nominalismus]

So I looked over the tutorial for the Memtest86+ and before I do it (which plausibly would be a couple of days from now because of all the grading and editing I have to do this week....) I just want to ask if this involves like opening my computer? I'm not totally sure what a RAM stick is or any of that....
If it involves that sort of thing, I'm kind of out of my league. I don't even know how to open this thing and once I got inside, I wouldn't be able to identify pretty much anything....

But thank you for your help! I still really appreciate this.

 

[Laith]

Well, it's simple even for a beginner. You just open up the computer and find the RAM sticks on the motherboard. I'll attach pictures of how RAM sticks can look like.

 

[nominalismus]

Ok. I just don't know how to open the computer. Are there any alternatives to doing this? I'm really afraid that I would mess something up if I fiddled with the internal parts of my laptop.

 

[nominalismus]

Just in the interest of updates, I did some sleuthing and ran through CCleaner again and disk check (as an administrator this time, which I didn't know was an option--I cleaned out the Windows Update backlogs, which bought be back about 1 gb--that said, I turned the computer back on about 2 minutes ago and already it's down from 24 gb to 23.9 gb--which isn't a big difference, but it seems to be going pretty fast.