Hi JustRelaxASC.
Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.
If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.
If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.
Information
Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.
How Can we know that DV is enabled:
It will make the system bit of slow, laggy.
Warning
Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using
CCleaner looking at Tools > System Restore.
If there is no points,
make a System Restore Point manually before enabling DV.
Let us know the results, with the subsequent crash dumps, if any.
_______________________________________
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002d346aa, fffff88009a9f980, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29a8a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002d346aa, Address of the instruction which caused the bugcheck
Arg3: fffff88009a9f980, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt! ?? ::FNODOBFM::`string'+29a8a
fffff800`02d346aa 4d8b7d00 mov r15,qword ptr [r13]
CONTEXT: fffff88009a9f980 -- (.cxr 0xfffff88009a9f980;r)
rax=0000000000000010 rbx=0000000000000060 rcx=0000000000000002
rdx=000000000000001a rsi=00fff8a0027d00e0 rdi=000000000000000c
rip=fffff80002d346aa rsp=fffff88009aa0360 rbp=fffff88009aa0620
r8=000000000000000c r9=fffffa8009964b50 r10=000000000000000f
r11=01d0000162b0f921 r12=fffffa8009a65630 r13=00000280099ece90
r14=0000000fffffffff r15=fffffa80099ece10
iopl=0 nv up ei pl nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010216
nt! ?? ::FNODOBFM::`string'+0x29a8a:
fffff800`02d346aa 4d8b7d00 mov r15,qword ptr [r13] ds:002b:00000280`099ece90=????????????????
Last set context:
rax=0000000000000010 rbx=0000000000000060 rcx=0000000000000002
rdx=000000000000001a rsi=00fff8a0027d00e0 rdi=000000000000000c
rip=fffff80002d346aa rsp=fffff88009aa0360 rbp=fffff88009aa0620
r8=000000000000000c r9=fffffa8009964b50 r10=000000000000000f
r11=01d0000162b0f921 r12=fffffa8009a65630 r13=00000280099ece90
r14=0000000fffffffff r15=fffffa80099ece10
iopl=0 nv up ei pl nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010216
nt! ?? ::FNODOBFM::`string'+0x29a8a:
fffff800`02d346aa 4d8b7d00 mov r15,qword ptr [r13] ds:002b:00000280`099ece90=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002d346aa
STACK_TEXT:
fffff880`09aa0360 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x29a8a
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+29a8a
fffff800`02d346aa 4d8b7d00 mov r15,qword ptr [r13]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+29a8a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5315a462
IMAGE_VERSION: 6.1.7601.22616
STACK_COMMAND: .cxr 0xfffff88009a9f980 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!_??_::FNODOBFM::_string_+29a8a
BUCKET_ID: X64_0x3B_nt!_??_::FNODOBFM::_string_+29a8a
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x3b_nt!_??_::fnodobfm::_string_+29a8a
FAILURE_ID_HASH: {5740a445-95fb-a015-e15a-0c437f615410}
Followup: MachineOwner
---------