BSOD Randomly

The win32k dump file was corrupt and was not able to be debugged.
There was a misbehaving hardware driver identified in memory dump.
The memory testing results will be useful to rule in / out RAM as a potential cause of the different bugchecks.

What information was found about the driver easy installed drivers?

For the next BSOD post a BETA zip and a memory dump.

The hardware driver can be uninstalled and reinstalled or another BSOD dump file debugging can be performed for confirmation before troubleshooting the drivers.

Philc43 may prefer one method compared to the other.

Open administrative command prompt and type or copy and paste:
sfc /scannow
dism /online /cleanup-image /restorehealth
chkdsk /scan
When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

I was unable to spend time debugging yesterday so will look at the new crash dumps today.

Results from last nights memtest with 4 modules.

Unfortunately I can't remove the left 2 memory modules as I have piping blocking them.

Uninstalled driver easy but didn't have a restore point for some reason. A fresh install might have to be the way to go.

Ordinarily when the Memtest fails with multiple RAM modules all modules are removed and then one module is tested in the same DIMM to differentiate good from malfunctioning RAM. This testing also allows possible interpretation of DIMM or MB problems.

If there are two RAM modules that cannot be removed the testing is limited to testing these two modules in their respective DIMM for 8 or more passes. Please post images for any Memtest results into the thread.

If the two RAM modules pass that cannot be removed then test each of the remaining RAM modules in the same DIMM for 8 or more passes to different good from Malfunctioning RAM.

Command Prompt Scan

Microsoft Windows [Version 10.0.17134.376]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.17134.1

Image Version: 10.0.17134.376

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
689152 file records processed.
File verification completed.
13810 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
2413 reparse records processed.
826526 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
2413 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
68688 data files processed.
CHKDSK is verifying Usn Journal...
41324872 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

499527679 KB total disk space.
272867424 KB in 403744 files.
238548 KB in 68689 indexes.
0 KB in bad sectors.
818127 KB in use by the system.
65536 KB occupied by the log file.
225603580 KB available on disk.

4096 bytes in each allocation unit.
124881919 total allocation units on disk.
56400895 allocation units available on disk.

C:\WINDOWS\system32>

Latest BSOD logs

There is a possible clue in one of the recent crash dumps that the Samsung NVMe driver is possibly involved. Are there any updates for the Samsung disk that you can apply? Look for a driver that is newer than Feb2018.

Code:

1: kd> .load pde;!dpx
Start memory scan  : 0xffff9500b2b30b78 ($csp)
End memory scan    : 0xffff9500b2b31000 (ISR Stack Base)

0xffff9500b2b30bd8 : 0xfffff800538ea1ad : nt!KiUpdateRunTime+0x5d
0xffff9500b2b30c28 : 0xfffff800538eb293 : nt!KeClockInterruptNotify+0x8f3
0xffff9500b2b30ca8 : 0xfffff80053bbffe8 : nt!KiClockTickTraces+0x108
0xffff9500b2b30ce8 : 0xfffff80053839531 : nt!KeInsertQueueDpc+0x11
0xffff9500b2b30d28 : 0xfffff8031b0a259a : storport!StorPortNotification+0x2aa
0xffff9500b2b30d58 : 0xfffff800538bddbd : nt!EtwpUnlockBufferList+0x21
Unable to load image \SystemRoot\System32\drivers\secnvme.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for secnvme.sys
*** ERROR: Module load completed but symbols could not be loaded for secnvme.sys
0xffff9500b2b30da8 : 0xfffff80053a4db8c : nt!KiAcquireSpinLockInstrumented+0x64
0xffff9500b2b30df0 : 0xffff9500b2b62f80 : 0xfffff80053bb4848 : nt!PpmCheckStartDpc+0x8
0xffff9500b2b30e38 : 0xfffff800538e880c : nt!EtwpLogKernelEvent+0x33c
0xffff9500b2b30f38 : 0xfffff8005415f883 : hal!HalpTimerClockInterrupt+0x63
0xffff9500b2b30f68 : 0xfffff80053937d75 : nt!KiCallInterruptServiceRoutine+0xa5
0xffff9500b2b30fa8 : 0xfffff800539b5d4a : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
0xffff9500b2b30fd8 : 0xfffff800539b6237 : nt!KiInterruptDispatchNoLockNoEtw+0x37

1: kd> lmvm secnvme
Browse full module list
start             end                 module name
fffff803`1b130000 fffff803`1b153000   secnvme  T (no symbols)           
    Loaded symbol image file: secnvme.sys
    Image path: \SystemRoot\System32\drivers\secnvme.sys
    Image name: secnvme.sys
    Browse all global symbols  functions  data
    Timestamp:        Mon Feb 12 00:33:59 2018 (5A815177)
    CheckSum:         00030116
    ImageSize:        00023000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

The scannow command found operating system corruption and was able to fix it.
Run the command again to see whether or not it was a temporary or full fix > report the results into the thread

In two of the minidumps there were misbehaving software drivers related to the antivirus software.

Philc43 may prefer to see what happens with secnvme.sys.

Open file explorer > this PC > C: > in the right upper corner search for: C:\Windows\memory.dmp > zip > post a share link into the thread

Code:

Crash dump found at C:\WINDOWS\MEMORY.DMP
Creation date: 11/03/2018 19:20:40
Size on disk: 1438 MB

klhk.sys and klif.sys

Code:

5: kd> .bugcheck
Bugcheck code 0000007F
Arguments 00000000`00000008 ffff9200`a3ac3670 00000000`238a2509 fffff802`c5c4be9b
5: kd> .time
Debug session time: Sat Nov  3 14:09:50.514 2018 (UTC - 5:00)
System Uptime: 0 days 0:50:44.227

Code:

1: kd> .bugcheck
Bugcheck code 00000101
Arguments 00000000`00000006 00000000`00000000 ffff9500`b3080180 00000000`00000008
1: kd> .time
Debug session time: Sat Nov  3 13:16:52.385 2018 (UTC - 5:00)
System Uptime: 0 days 0:02:35.094

Philc43 = Has the latest driver but the firmware seemed to be out of date. Now updated

Scanned again

Microsoft Windows [Version 10.0.17134.376]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

--------------------------------------

Failed to zip the memory dump, got message"File not found or no read permission"