Question Frequent BSODs ?

osismartins50

Honorable
Oct 2, 2018
7
0
10,510
Hi, few months ago i built my first PC, everything was running great for a month, two max.

But now I'm getting frequent bluescreens with this error code: IRQL_NOT_LESS_OR_EQUAL (a)

Was googling around, but can't find any info that would help me figure out whats wrong.

PC Specs
MB: B450M Pro4 R2.0
CPU: AMD Ryzen 5 5600X
GPU: AMD Radeon RX 6600
RAM: GSkill AEGIS DDR4 16gx2 XMP 2.0 Ready
PSU: Aerocool Integrator 600W

dump file

 
dump looked like a stack overflow.


old driver:
rtcx21x64.sys Sun Oct 3 23:54:20 2021

have not seen these drivers before:
Media.sys Sat Apr 12 23:48:09 2025
x0904hlp.sys Wed Apr 9 11:05:35 2025

this is installed;
EasyAntiCheat_EOS.sys Wed Apr 16 05:13:04 2025
overclock driver running:
AMDRyzenMasterDriver.sys Mon Sep 2 23:16:28 2024
not sure what ArV.SYS is for.
 
media.sys might be for media tek solid state NVMe
(i did not see the chip in the motherboard specs)
I would try to find out what
x0904hlp.sys
and
arv.sys
could be for. (maybe do a virus scan)
not a good sign if you can not find a driver name on google.
motherboard came out in 2022

i would be looking for malware.
 
Last edited:
atm i have found x0904hlp.sys
Code:
[Version]
Signature   ="$WINDOWS NT$"
Class       = System
ClassGUID   = {4d36e97d-e325-11ce-bfc1-08002be10318}
Provider    = %Vendor%
DriverVer = 04/09/2025,3.36.0.0
CatalogFile = x0904hlp.cat

[DestinationDirs]
DefaultDestDir = 12

[SourceDisksNames.amd64]
1 = %DisplayName%

[SourceDisksFiles.amd64]
x0904hlp.sys = 1

[Manufacturer]
%Vendor% = Vendor, NTamd64

[Vendor.NTamd64]
%DisplayName%  = Install, root\x0904hlp
%DisplayName2% = Install, BTHENUM\{f2fe18ec-4bca-481e-a03e-e1a02ba84ee2}

[Install.NTamd64]
CopyFiles = Drivers_Dir

[Install.NTamd64.HW]
AddReg = Security_Reg

[Security_Reg]
HKR,,DeviceCharacteristics,0x10001,0x0100
HKR,,Security,,"D:P(A;;GA;;;SY)(A;;GR;;;BA)(A;;GR;;;WD)(A;;GR;;;RC)"

[Install.NTamd64.Services]
AddService = x0904hlp, 2, Service_Inst

[Service_Inst]
DisplayName    = %DisplayName%
Description    = %Description%
ServiceType    = 1
StartType      = 0
ErrorControl   = 1
LoadOrderGroup = Filter
ServiceBinary  = %12%\x0904hlp.sys

[Drivers_Dir]
x0904hlp.sys

[Strings]
DisplayName  = "Helper Driver"
DisplayName2 = "Virtual Bluetooth HID Device"
Description  = "Helper Driver"
Vendor       = "Disc Soft Ltd"


edit: added screenshot
 
Last edited:
media.sys might be for media tek solid state NVMe
(i did not see the chip in the motherboard specs)
I would try to find out what
x0904hlp.sys
and
arv.sys
could be for. (maybe do a virus scan)
not a good sign if you can not find a driver name on google.
motherboard came out in 2022

i would be looking for malware.
Also found media.sys and arv.sys both were in C:\Windows No idea what they are for.. Can i just delete them?
 
if you think it is malware you would want to run a malware scan. often malware will disable windows defender so I would check it to see if it is still running on your computer.
best if you can get a malware scanner to remove it, if it is malware.

you could also, turn of the system virtual memory to delete the pagefile.sys then download and run microsoft autoruns64 as an admin then find the drivers and delete or uncheck the driver name so it will not get loaded on reboot.
then reboot.

malware can be tricky, I have seen some that would make another module at exit of the first module. IE you terminate it and it comes back under a different name.

deleting the pagefile.sys rebooting and making another pagefile.sys can help dump some malware hiding in the pagefil.sys. (ie turn off virtual memory ,reboot and turn it back on)
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

malwarebytes scanner used to be pretty good at finding adware. they ignored the fact that you may have given permission to the malware installer to run.
(malware companies sued the malware blockers that removed their software, they put a clause in the license agreement saying they can do anything to your computer and the enduser agreed to it so they sue the scanner companies that remove their software)
 
Last edited: