Frequent BSODs ?
Frequent BSODs ?
Brady514166
04-29-2016, 07:35 AM #1Hi, a few months ago I assembled my first PC and everything worked perfectly for a month. Now I'm experiencing frequent bluescreens with the error code IRQL_NOT_LESS_OR_EQUAL (a). I've searched online but haven't found any useful information to diagnose the issue.
old driver information:
rtcx21x64.sys Sun Oct 3 23:54:20 2021
no similar drivers encountered before:
Media.sys Sat Apr 12 23:48:09 2025
x0904hlp.sys Wed Apr 9 11:05:35 2025
installation confirmed;
EasyAntiCheat_EOS.sys Wed Apr 16 05:13:04 2025
overclock driver active:
AMDRyzenMasterDriver.sys Mon Sep 2 23:16:28 2024
uncertain about the purpose of ArV.SYS.
dump appeared to be a stack overflow error.
old driver information:
rtcx21x64.sys Sun Oct 3 23:54:20 2021
no similar drivers encountered before:
Media.sys Sat Apr 12 23:48:09 2025
x0904hlp.sys Wed Apr 9 11:05:35 2025
installation confirmed;
EasyAntiCheat_EOS.sys Wed Apr 16 05:13:04 2025
overclock driver active:
AMDRyzenMasterDriver.sys Mon Sep 2 23:16:28 2024
uncertain about the purpose of ArV.SYS.
Scra3mITout
05-05-2016, 06:27 PM #5media.sys could relate to media tek solid state NVMe. I didn't see the chip listed in the motherboard specifications. I'm checking x0904hlp.sys and arv.sys to see what they're for, maybe run a virus scan. It's not a good sign if we can't find a driver name on Google. The board was released in 2022, so I'm focusing on malware.
Code details are as follows:
Version: [Version]
Signature: $WINDOWS NT$
Class: System
ClassGUID: 4d36e97d-e325-11ce-bfc1-08002be10318
Provider: %Vendor%
DriverVer: 04/09/2025,3.36.0.0
CatalogFile: x0904hlp.cat
Destination directories:
DefaultDestDir = 12
Source disk names (AMD64):
1 = %DisplayName%
Source disk files (AMD64):
x0904hlp.sys = 1
Manufacturer information:
%Vendor% = Vendor, NTamd64
Vendor details:
%DisplayName% = Install, root\x0904hlp
%DisplayName2% = Install, BTHENUM\{f2fe18ec-4bca-481e-a03e-e1a02ba84ee2}
Installation notes:
[Install.NTamd64] CopyFiles = Drivers_Dir
[Install.NTamd64.HW] AddReg = Security_Reg
[Security_Reg]
HKR,,DeviceCharacteristics,0x10001,0x0100
HKR,,Security,,"D
(A;;GA;;SY)(A;;GR;;BA)(A;;GR;;WD)(A;;GR;;RC)" Service installation:
[Service_Inst]
DisplayName = %DisplayName%
Description = %Description%
ServiceType = 1
StartType = 0
ErrorControl = 1
LoadOrderGroup = Filter
ServiceBinary = %12%\x0904hlp.sys
Drivers directory: x0904hlp.sys
Strings:
DisplayName = "Helper Driver"
DisplayName2 = "Virtual Bluetooth HID Device"
Description = "Helper Driver"
Vendor = "Disc Soft Ltd"
Link: https://imgur.com/a/RYDaW8k
Edit note: Added screenshot
I have located the file x0904hlp.sys
Code details are as follows:
Version: [Version]
Signature: $WINDOWS NT$
Class: System
ClassGUID: 4d36e97d-e325-11ce-bfc1-08002be10318
Provider: %Vendor%
DriverVer: 04/09/2025,3.36.0.0
CatalogFile: x0904hlp.cat
Destination directories:
DefaultDestDir = 12
Source disk names (AMD64):
1 = %DisplayName%
Source disk files (AMD64):
x0904hlp.sys = 1
Manufacturer information:
%Vendor% = Vendor, NTamd64
Vendor details:
%DisplayName% = Install, root\x0904hlp
%DisplayName2% = Install, BTHENUM\{f2fe18ec-4bca-481e-a03e-e1a02ba84ee2}
Installation notes:
[Install.NTamd64] CopyFiles = Drivers_Dir
[Install.NTamd64.HW] AddReg = Security_Reg
[Security_Reg]
HKR,,DeviceCharacteristics,0x10001,0x0100
HKR,,Security,,"D(A;;GA;;SY)(A;;GR;;BA)(A;;GR;;WD)(A;;GR;;RC)"
Service installation:
[Service_Inst]
DisplayName = %DisplayName%
Description = %Description%
ServiceType = 1
StartType = 0
ErrorControl = 1
LoadOrderGroup = Filter
ServiceBinary = %12%\x0904hlp.sys
Drivers directory: x0904hlp.sys
Strings:
DisplayName = "Helper Driver"
DisplayName2 = "Virtual Bluetooth HID Device"
Description = "Helper Driver"
Vendor = "Disc Soft Ltd"
Link: https://imgur.com/a/RYDaW8k
Edit note: Added screenshot
ideally, use a malware scanner to eliminate it if detected.
alternatively, you might disable the system’s virtual memory, delete the pagefile.sys file, then run microsoft autoruns64 as an administrator to locate and remove or uncheck problematic drivers that could be loaded on startup. restart the computer afterward.
malware can be challenging; i’ve encountered cases where it creates another module upon exiting a previous one—terminating the first may not fully resolve the issue.
recreating pagefile.sys after rebooting can sometimes expose hidden malware. (note: this involves turning off virtual memory, restarting, and then restoring.)
malwarebytes was once effective at detecting adware, but it overlooked the possibility that you might have allowed the installer to run.
there’s a legal angle here—some malware companies have sued scanner providers, arguing they can remove their software without restriction, while users have agreed to such terms.
TheHornyBull
05-08-2016, 07:37 AM #8if you suspect it is malicious software, performing a malware scan would be advisable. often such threats disable windows defender, so checking for its presence helps determine if it remains active on your system.
ideally, use a malware scanner to eliminate it if detected.
alternatively, you might disable the system’s virtual memory, delete the pagefile.sys file, then run microsoft autoruns64 as an administrator to locate and remove or uncheck problematic drivers that could be loaded on startup. restart the computer afterward.
malware can be challenging; i’ve encountered cases where it creates another module upon exiting a previous one—terminating the first may not fully resolve the issue.
recreating pagefile.sys after rebooting can sometimes expose hidden malware. (note: this involves turning off virtual memory, restarting, and then restoring.)
malwarebytes was once effective at detecting adware, but it overlooked the possibility that you might have allowed the installer to run.
there’s a legal angle here—some malware companies have sued scanner providers, arguing they can remove their software without restriction, while users have agreed to such terms.