What is the SYSTEM_SERVICE_EXCEPTION stop code (0x0000003B)?

Stop code 0x0000003B means a kernel-mode routine on your Windows PC raised an exception that the system's error handler could not recover from. This causes an immediate blue screen (BSOD) to prevent further data corruption. The most common triggers are buggy or outdated drivers, corrupted Windows system files, failing RAM, or a disk with bad sectors.

Why does SYSTEM_SERVICE_EXCEPTION reference ntfs.sys or fltmgr.sys?

ntfs.sys is the Windows NTFS file system driver; fltmgr.sys is the Filter Manager that sits between applications and the file system. When these appear in the crash dump, the issue is usually disk corruption, a failing drive, or a third-party file system filter (such as antivirus or backup software) that hooks into file I/O. Run CHKDSK (/f /r) and check your drive's SMART health immediately.

How do I fix SYSTEM_SERVICE_EXCEPTION caused by nvlddmkm.sys or amdkmdag.sys?

These are NVIDIA and AMD GPU kernel-mode drivers. The fix is to boot into Safe Mode, use Display Driver Uninstaller (DDU) to completely remove the current graphics driver, then download and install the latest WHQL driver from the official NVIDIA or AMD website. Also disable any overlay software (GeForce Experience, Radeon Software Adrenalin overlays, Discord in-game overlay) and hardware monitoring tools that hook into the GPU driver stack.

Why does SYSTEM_SERVICE_EXCEPTION only happen when I'm playing games?

Gaming stresses the GPU, CPU, RAM, and storage simultaneously. The most common causes during gaming are an overheating or unstable GPU driver (nvlddmkm.sys / amdkmdag.sys / dxgkrnl.sys), DirectX-related driver bugs, or RAM instability exposed under load. Start by updating your GPU driver, ensuring your GPU temperature stays below 85°C under load, and running MemTest86 to rule out bad RAM.

Can a Windows Update cause SYSTEM_SERVICE_EXCEPTION?

Yes. Microsoft's cumulative updates sometimes ship with driver components (especially for win32kfull.sys, win32kbase.sys, or network stack drivers) that conflict with existing third-party drivers. If your BSOD started directly after an update, go to Settings → Windows Update → Update History → Uninstall Updates, find the most recent KB entry, and uninstall it. You can also use System Restore to roll back to a pre-update restore point.

SYSTEM_SERVICE_EXCEPTION (0x0000003B): Complete Blue Screen Fix Guide for Windows 10 & 11

Fix the SYSTEM_SERVICE_EXCEPTION BSOD (stop code 0x0000003B) on Windows 10/11. Step-by-step diagnosis with driver, memory, and system file repair commands.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,111 words

Key Takeaways

Root cause #1: A faulty or outdated kernel-mode driver (e.g., nvlddmkm.sys, amdkmdag.sys, ntfs.sys, win32kfull.sys) executes an illegal operation, causing Windows to halt with stop code 0x0000003B.
Root cause #2: Corrupted system files, bad RAM, or conflicting third-party software (antivirus, virtual machine tools, audio drivers) trigger the exception in kernel space.
Root cause #3: Overclocking instability, hardware failures (GPU, storage), or a recent Windows Update introducing an incompatible driver version.
Quick fix summary: Run SFC and DISM to repair system files, update or roll back the offending driver identified in the minidump, test RAM with Windows Memory Diagnostic, and perform a clean boot to isolate third-party software conflicts.

Fix Approaches Compared
Method	When to Use	Time	Risk
SFC /scannow + DISM	Corrupted Windows system files suspected; first-line repair	10-20 min	Low
Driver rollback / update	Crash dump points to a specific .sys file (nvlddmkm.sys, amdkmdag.sys, etc.)	5-15 min	Low
Windows Memory Diagnostic / MemTest86	Random BSODs with no consistent .sys file; suspected bad RAM	30 min – 8 hrs	None
Clean Boot (msconfig)	BSOD only under specific software load (games, VMware, audio apps)	10 min setup	Low
Uninstall Recent Windows Update	BSOD started after a Patch Tuesday or feature update	10-20 min	Medium
CHKDSK on system drive	ntfs.sys or fltmgr.sys implicated; possible disk corruption	15-60 min	Low
Reinstall / fresh install Windows	All other methods failed; persistent BSOD on every boot	1-2 hrs	High (data loss risk)

Understanding the SYSTEM_SERVICE_EXCEPTION Error

The SYSTEM_SERVICE_EXCEPTION blue screen (stop code 0x0000003B) fires when a routine running in kernel mode encounters an unexpected exception that the operating system's exception handler cannot recover from. Unlike user-mode crashes that simply kill an application, a kernel-mode fault takes down the entire system to prevent data corruption.

The exact message on screen reads:

Your PC ran into a problem and needs to restart.
Stop code: SYSTEM_SERVICE_EXCEPTION

In older Windows versions the hex form 0x0000003B appears alongside a secondary parameter identifying the underlying exception code (e.g., 0xC0000005 = access violation, 0xC0000034 = object not found).

Step 1: Read the Minidump File to Identify the Culprit

The most reliable way to fix this error is to find which .sys or .dll file triggered the crash.

Open Event Viewer → Windows Logs → System, filter for event ID 1001 (BugCheck).
Alternatively, use the free tool WinDbg or WhoCrashed to parse the minidump automatically.

Minidumps are stored at C:\Windows\Minidump\ as .dmp files. Common offending modules include:

Module	Likely Cause
`nvlddmkm.sys`	NVIDIA GPU driver crash
`amdkmdag.sys`	AMD/ATI GPU driver crash
`ntfs.sys`	NTFS file system / disk corruption
`win32kfull.sys`, `win32kbase.sys`	Windows graphics subsystem, often triggered by display drivers or third-party overlay software
`fltmgr.sys`	File system filter driver (antivirus, backup agents)
`ndis.sys`, `netio.sys`	Network driver or VPN client conflict
`ntoskrnl.exe`	Core kernel issue — often points to RAM or hardware
`cdd.dll`	Canonical Display Driver — remote desktop or virtual GPU issues
`dxgkrnl.sys`, `dxgmms1.sys`	DirectX Graphics Kernel — GPU/driver crash during gaming
`wdf01000.sys`	Windows Driver Framework — USB or peripheral driver
`cldflt.sys`	OneDrive cloud file filter driver
`ndu.sys`	Windows Network Data Usage monitoring driver

Step 2: Repair System Files with SFC and DISM

Before touching drivers, rule out OS-level corruption.

Open an elevated Command Prompt (Run as Administrator) and run:

sfc /scannow

This scans and repairs protected Windows files. If it reports that it could not fix some files, proceed with DISM:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Restart after completion, then run sfc /scannow once more to confirm repairs.

Step 3: Update or Roll Back the Offending Driver

If the crash dump names a GPU driver (nvlddmkm.sys / amdkmdag.sys):

Boot into Safe Mode (hold Shift while clicking Restart → Troubleshoot → Advanced Options → Startup Settings → Safe Mode with Networking).
Use DDU (Display Driver Uninstaller) in Safe Mode to completely remove the current GPU driver.
Download the latest WHQL-certified driver directly from NVIDIA (nvidia.com/drivers) or AMD (amd.com/support).
Install and reboot normally.

If the crash dump names win32kfull.sys or win32kbase.sys:

This often indicates a conflict with screen overlay tools (Discord, GeForce Experience, MSI Afterburner), antivirus software hooking into the graphics stack, or a bad Windows cumulative update. Try:

Disabling hardware acceleration in overlay applications.
Rolling back the latest cumulative update via Settings → Windows Update → Update History → Uninstall Updates.

Rolling back any driver via Device Manager:

Press Win + X → Device Manager.
Locate the device (Display Adapters, Network Adapters, etc.).
Right-click → Properties → Driver tab → Roll Back Driver.

Step 4: Check Disk Health (for ntfs.sys / fltmgr.sys BSODs)

Run CHKDSK to find and repair file system errors:

chkdsk C: /f /r /x

You will be prompted to schedule the scan on next reboot. Type Y and restart. This scan can take 30-60 minutes on large or nearly full drives.

Also check SMART health with:

wmic diskdrive get status

Or use CrystalDiskInfo for a detailed SMART report.

Step 5: Test RAM (for ntoskrnl.exe or Random BSODs)

Open the Windows Memory Diagnostic tool:

mdsched.exe

Choose to restart now and check for problems. For more thorough testing, boot from a MemTest86 USB and run at least two full passes. Any errors confirm faulty RAM — reseat or replace the affected stick(s).

Step 6: Clean Boot to Isolate Third-Party Software

If the BSOD happens only during gaming, when VMware Workstation is running, or when a specific app is open:

Press Win + R → type msconfig → Services tab → check Hide all Microsoft services → click Disable all.
Go to the Startup tab → Open Task Manager → disable all startup items.
Restart and reproduce the crash. If stable, re-enable services in batches to identify the conflict.

Common culprits found this way include: audio drivers (rtkvhd64.sys, asio.sys, spuvcbv64.sys), antivirus kernel components, VPN drivers (ndis.sys via third-party clients), and hardware monitoring tools (gdrv3.sys from Gigabyte utilities).

Step 7: Advanced — Analyze the Dump with WinDbg

Install WinDbg from the Microsoft Store or the Windows SDK. Then:

Open WinDbg → File → Open Crash Dump → select the latest .dmp from C:\Windows\Minidump\.
In the command window, type:

!analyze -v

This outputs the full call stack, the faulting module, and the exception code. Look for lines like:

FAULTING_MODULE: fffff800`12345678 nvlddmkm
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p.

Use the module name to target your fix precisely.

Step 8: Check for Windows Updates and BIOS/UEFI Firmware

Sometimes Microsoft ships a patch specifically addressing a kernel exception. Go to Settings → Windows Update → Check for updates. Also visit your motherboard manufacturer's website and update the BIOS/UEFI firmware, as outdated firmware can cause hardware-software miscommunication leading to kernel exceptions.

Special Cases

VMware Workstation: If the BSOD occurs only while VMware is running, update VMware to the latest version and ensure Hyper-V is either fully enabled or fully disabled (they conflict). Run bcdedit /set hypervisorlaunchtype off if you want VMware's own hypervisor.

Windows 8.1 / Windows 10 version 1903 and older: The cng.sys (Cryptography Next Generation) crash is often tied to TPM driver conflicts or outdated secure boot firmware. Update all chipset drivers from the OEM's support page.

cldflt.sys (OneDrive): Temporarily pause OneDrive sync or sign out of OneDrive, then check if the BSOD recurs. Update or reinstall OneDrive if it persists.

irql_not_less_or_equal alongside SYSTEM_SERVICE_EXCEPTION: When both codes appear, a driver is accessing memory at an incorrect IRQL. The fix is almost always a driver update or removal — focus on recently installed drivers first.

Frequently Asked Questions

powershell

# ============================================================
# SYSTEM_SERVICE_EXCEPTION (0x0000003B) - Diagnostic & Fix Script
# Run PowerShell as Administrator
# ============================================================

# 1. Display recent BugCheck events from the System log
Write-Host "=== Recent BugCheck Events ==" -ForegroundColor Cyan
Get-WinEvent -LogName System -MaxEvents 50 | Where-Object { $_.Id -eq 1001 } |
    Select-Object TimeCreated, Message | Format-List

# 2. List all minidump files with dates
Write-Host "`n=== Minidump Files ==" -ForegroundColor Cyan
Get-ChildItem "C:\Windows\Minidump\" -Filter "*.dmp" -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, Length

# 3. Run System File Checker
Write-Host "`n=== Running SFC /scannow ==" -ForegroundColor Cyan
sfc /scannow

# 4. Run DISM health restore
Write-Host "`n=== Running DISM RestoreHealth ==" -ForegroundColor Cyan
DISM /Online /Cleanup-Image /RestoreHealth

# 5. Schedule CHKDSK on next reboot (for ntfs.sys / disk issues)
Write-Host "`n=== Scheduling CHKDSK on C: ==" -ForegroundColor Cyan
echo Y | chkdsk C: /f /r /x

# 6. Check disk SMART status via WMI
Write-Host "`n=== Disk SMART Status ==" -ForegroundColor Cyan
Get-WmiObject -Class Win32_DiskDrive | Select-Object DeviceID, Status, Size, Model

# 7. List third-party kernel drivers (non-Microsoft signed)
Write-Host "`n=== Third-Party Kernel Drivers ==" -ForegroundColor Cyan
Get-WmiObject Win32_SystemDriver | Where-Object { $_.State -eq 'Running' } |
    Select-Object Name, PathName, Description | Sort-Object Name | Format-Table -AutoSize

# 8. Check for recently installed drivers (last 30 days)
Write-Host "`n=== Drivers Installed in Last 30 Days ==" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-30)
Get-WinEvent -LogName System -MaxEvents 5000 | Where-Object {
    $_.Id -in @(7045, 20001, 20003) -and $_.TimeCreated -gt $cutoff
} | Select-Object TimeCreated, Message | Format-List

# 9. Run Windows Memory Diagnostic (schedules on next reboot)
Write-Host "`n=== Launching Windows Memory Diagnostic ==" -ForegroundColor Cyan
Start-Process mdsched.exe

# 10. Export current driver list to CSV for review
$driverCsv = "$env:USERPROFILE\Desktop\driver_list.csv"
Get-WmiObject Win32_SystemDriver | Select-Object Name, State, StartMode, PathName |
    Export-Csv -Path $driverCsv -NoTypeInformation
Write-Host "`nDriver list exported to: $driverCsv" -ForegroundColor Green

# 11. Optional: Disable ndu.sys (known BSOD trigger on some systems)
# Uncomment the lines below ONLY if ndu.sys appears in your crash dump
# Write-Host "`n=== Disabling ndu.sys ==" -ForegroundColor Yellow
# Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Ndu" -Name "Start" -Value 4
# Write-Host "ndu.sys disabled. Reboot required." -ForegroundColor Yellow

Write-Host "`n=== Diagnostics Complete. Please reboot to apply CHKDSK. ==" -ForegroundColor Green

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows systems specialists with over 15 years of combined experience diagnosing kernel-mode failures, BSOD root causes, and Windows reliability engineering. Our guides combine hands-on lab testing with real crash dump analysis to deliver actionable, accurate troubleshooting steps for developers and IT professionals.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.