What is stop code SYSTEM_SERVICE_EXCEPTION (0x0000003B) and what causes it?

Stop code 0x0000003B means a routine executing in kernel mode encountered an unhandled exception — typically an access violation (0xC0000005) or illegal instruction. The most common causes are: (1) a corrupt or incompatible device driver (GPU, NIC, audio, USB), (2) damaged Windows system files (ntfs.sys, win32kfull.sys), (3) faulty RAM, (4) overheating hardware, or (5) third-party kernel-mode software like antivirus or virtualization software that conflicts with the OS kernel.

How do I fix SYSTEM_SERVICE_EXCEPTION caused by ntfs.sys?

ntfs.sys crashes indicate NTFS filesystem corruption or bad disk sectors. Fix steps: (1) Open an elevated Command Prompt and run 'chkdsk C: /f /r', then reboot to let it run before Windows loads. (2) After CHKDSK completes, run 'sfc /scannow' and then 'DISM /Online /Cleanup-Image /RestoreHealth'. (3) If crashes continue, run CrystalDiskInfo to check the drive's SMART data — a failing drive should be replaced immediately. (4) On an SSD, update the SSD firmware from the manufacturer's website.

How do I fix SYSTEM_SERVICE_EXCEPTION from nvlddmkm.sys or amdkmdag.sys?

Both modules are GPU drivers — nvlddmkm.sys is NVIDIA and amdkmdag.sys is AMD. The best fix is a clean driver reinstall: (1) Download Display Driver Uninstaller (DDU) from Wagnardsoft. (2) Boot into Safe Mode (press F8 or use WinRE). (3) Run DDU and choose 'Clean and restart'. (4) Download the latest stable GPU driver directly from nvidia.com or amd.com. (5) Install using the 'Custom' option and check 'Perform a clean installation'. If crashes continue on the latest driver, roll back to the previous version using Device Manager → Display Adapters → Properties → Driver tab → Roll Back Driver.

Why do I get SYSTEM_SERVICE_EXCEPTION only when playing games?

Gaming triggers high GPU utilization, elevated CPU frequency, and intensive memory access — all of which stress components that may be marginal. If crashes happen only during gaming: (1) The GPU driver is the prime suspect — perform a clean reinstall with DDU. (2) Check GPU temperature with GPU-Z or HWiNFO64; if it exceeds 85–90°C, clean the GPU heatsink or replace thermal pads. (3) If you are overclocking the GPU or CPU, reset to stock clocks first. (4) Check RAM stability with MemTest86 — gaming loads large textures that stress memory bandwidth. (5) Ensure your power supply can deliver enough wattage — an underpowered PSU causes voltage sags that destabilize the GPU driver.

SYSTEM_SERVICE_EXCEPTION stop code appears with 'not handled' — what does that mean?

'SYSTEM_SERVICE_EXCEPTION (not handled)' or 'SYSTEM_SERVICE_EXCEPTION_NOT_HANDLED' indicates that the exception was not caught by any exception handler in the call stack, making it more severe. It is functionally diagnosed the same way as the standard 0x0000003B. Focus first on identifying the named module in the crash dump using WinDbg ('!analyze -v'), then follow the driver-specific or system-file repair steps above. If the module is ntoskrnl.exe itself, run 'sfc /scannow' and 'DISM /RestoreHealth' and apply all pending Windows Updates.

SYSTEM_SERVICE_EXCEPTION (0x0000003B): Complete Fix Guide for Windows 10 & 11

Fix the SYSTEM_SERVICE_EXCEPTION BSOD (stop code 0x0000003B) on Windows 10/11. Step-by-step diagnosis for ntfs.sys, nvlddmkm.sys, win32kfull.sys & more.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,150 words

Key Takeaways

Root cause: A kernel-mode system service routine transitioned from non-privileged (user) code to privileged (kernel) code — most commonly triggered by a corrupt or incompatible device driver (GPU, NIC, filesystem filter), a damaged NTFS volume, or faulty RAM.
Root cause: The offending module is named in the stop screen (e.g., nvlddmkm.sys = NVIDIA GPU driver, amdkmdag.sys = AMD GPU driver, ntfs.sys = NTFS filesystem, win32kfull.sys = Windows GDI subsystem, netio.sys = network stack). Identifying the module is the fastest path to the right fix.
Quick fix summary: (1) Boot into Safe Mode, (2) run 'sfc /scannow' and 'DISM /RestoreHealth', (3) update or roll back the named driver, (4) run Windows Memory Diagnostic or MemTest86 for RAM, (5) run 'chkdsk /f /r' for disk errors, (6) as a last resort perform an in-place upgrade repair.

Fix Approaches Compared
Method	When to Use	Est. Time	Risk
Update / Roll Back Driver	Faulty module is a device driver (nvlddmkm.sys, amdkmdag.sys, netio.sys, etc.)	5–15 min	Low
SFC + DISM System File Repair	Stop code names ntoskrnl.exe, win32k.sys, win32kfull.sys, cdd.dll	15–30 min	Low
CHKDSK /f /r	Module is ntfs.sys or fltmgr.sys; system is on HDD	30–120 min	Low
Windows Memory Diagnostic / MemTest86	Crashes occur under load or after long uptime; no single module named	30–480 min	Low
Uninstall Conflicting Software	Crash after installing antivirus, VMware Workstation, audio (asio.sys, rtkvhd64.sys) or filter drivers	5–10 min	Low
Clean GPU Driver Install (DDU)	GPU-related modules: nvlddmkm.sys, amdkmdag.sys, igdkmd64.sys, dxgkrnl.sys, dxgmms1.sys	20–30 min	Low-Med
In-Place Upgrade Repair Install	Multiple crashes, several modules implicated, SFC/DISM unable to repair	60–90 min	Medium
Fresh Windows Install	All else fails; persistent corruption	90–180 min	High (data loss risk)

Understanding the SYSTEM_SERVICE_EXCEPTION Error

Windows stop code 0x0000003B — also displayed as SYSTEM_SERVICE_EXCEPTION — fires when a kernel exception occurs during the execution of a routine that transitioned from user mode to kernel mode. Windows cannot recover gracefully, so it triggers the Blue Screen of Death (BSOD) to prevent data corruption.

The full stop screen reads:

Your PC ran into a problem and needs to restart.
Stop code: SYSTEM_SERVICE_EXCEPTION

On older Windows builds you may see:

STOP: 0x0000003B (0x00000000C0000005, 0xFFFFF8000A1B3C40, 0xFFFFF88003A10000, 0x0000000000000000)

The second parameter is the exception code (e.g., 0xC0000005 = access violation) and the third parameter is the address inside the failing driver.

Step 1: Identify the Faulty Module

Before touching anything, capture the module name from the blue screen or from a minidump.

Option A — Read the BSOD directly. Modern Windows 10/11 crash screens show the file name below the stop code, e.g., amdkmdag.sys.

Option B — Analyze the minidump with WinDbg.

Open WinDbg (available from the Microsoft Store as "WinDbg Preview").
Go to File → Open Crash Dump and navigate to C:\Windows\Minidump\ — select the most recent .dmp file.
In the command pane run:
```
!analyze -v
```
Look for the MODULE_NAME and IMAGE_NAME fields.

Option C — Use WhoCrashed (free GUI tool) for a human-readable summary if WinDbg is unfamiliar.

Step 2: Boot Into Safe Mode (If System Won't Stay Up)

If the system blue-screens before you can log in:

Power the PC off during boot three times to trigger the Windows Recovery Environment (WinRE).
Navigate to Troubleshoot → Advanced Options → Startup Settings → Restart.
Press 4 or F4 for Safe Mode, or 5/F5 for Safe Mode with Networking.

Step 3: Fix Based on the Named Module

GPU Drivers — nvlddmkm.sys, amdkmdag.sys, igdkmd64.sys, dxgkrnl.sys, dxgmms1.sys

These are the most frequent culprits, especially when the crash occurs while gaming or running GPU-intensive workloads.

Download Display Driver Uninstaller (DDU) from Wagnardsoft.
Boot into Safe Mode.
Run DDU → "Clean and restart" to fully strip the GPU driver.
After reboot, install the latest stable driver directly from NVIDIA (nvlddmkm.sys), AMD (amdkmdag.sys), or Intel (igdkmd64.sys) — avoid bundled bloatware installers.
If crashing resumes on the latest driver, try one version older (driver regression is common).

Filesystem — ntfs.sys, fltmgr.sys, cldflt.sys

ntfs.sys crashes indicate NTFS volume corruption or a bad disk sector. fltmgr.sys and cldflt.sys point to file-system filter drivers (antivirus, cloud sync like OneDrive's cldflt.sys).

# Schedule CHKDSK on the system volume (requires reboot)
chkdsk C: /f /r /x

Restart — CHKDSK runs before Windows loads. For secondary drives omit /x.

If cldflt.sys is named, temporarily disable OneDrive or the cloud sync client and test.

Network Stack — netio.sys, ndis.sys, afd.sys, ndu.sys

Usually caused by a VPN driver, antivirus network filter, or out-of-date NIC driver.

Update your NIC driver from the manufacturer's website (Intel, Realtek, Killer).
Uninstall VPN software (especially older versions of OpenVPN, Cisco AnyConnect, or gaming VPNs).
Disable the Windows Network Data Usage monitor temporarily: sc config ndu start= disabled then reboot.

Windows Graphics Subsystem — win32kfull.sys, win32kbase.sys, win32k.sys, cdd.dll, dxgkrnl.sys

These modules live in the Windows GDI/DirectX kernel subsystem. Corruption here almost always means corrupted Windows system files or a bad cumulative update.

# Step 1: Repair system files
sfc /scannow

# Step 2: Repair the Windows image
DISM /Online /Cleanup-Image /RestoreHealth

# Step 3: Run SFC again after DISM
sfc /scannow

Reboot after each phase completes.

Audio — rtkvhd64.sys, spuvcbv64.sys, asio.sys, ks.sys

Realtek (rtkvhd64.sys) and ASIO audio drivers can destabilize the kernel.

Uninstall the current Realtek HD Audio driver via Device Manager.
Reinstall from the motherboard manufacturer's support page, not Windows Update.
For ASIO: update or uninstall the ASIO4ALL or vendor ASIO driver.

Security & Filter Drivers — cng.sys, gdrv3.sys, wdf01000.sys

cng.sys (Cryptography Next Generation): run sfc /scannow and apply all pending Windows Updates.
gdrv3.sys: this is a GIGABYTE utility driver known to cause BSODs. Uninstall GIGABYTE App Center / RGB Fusion.
wdf01000.sys (Windows Driver Framework): update all peripheral drivers (USB hubs, input devices).

Virtualization — VMware Workstation

VMware installs multiple kernel drivers. After a Windows major update these frequently break.

Uninstall VMware Workstation, reboot, confirm stability.
Reinstall the latest VMware Workstation version compatible with your Windows build.
Alternatively, switch to WSL 2 + Hyper-V for compatibility.

Step 4: Test RAM

If no single module is consistently named, or if the named module changes between crashes, suspect faulty RAM.

# Built-in Windows Memory Diagnostic
mdsched.exe

Choose "Restart now and check for problems." For more thorough testing, use MemTest86 (bootable USB, run for at least 2 full passes — ideally overnight).

If errors are found, reseat DIMMs, test one stick at a time, or replace the faulty module.

Step 5: Check System Temperatures and Hardware

Overheating causes random kernel exceptions. Use HWiNFO64 or Core Temp to monitor:

CPU temps should stay below 90°C under load.
GPU temps should stay below 85°C under load.

Clean dust from heatsinks and reapply thermal paste if the system is 3+ years old.

Step 6: In-Place Upgrade Repair (Last Resort Before Reinstall)

Download the Windows 11 (or 10) ISO from Microsoft.
Mount the ISO, run setup.exe.
Choose Keep personal files and apps.
This reinstalls all Windows system files without destroying your data or applications.

Step 7: Verify After Fixes

After any fix, stress-test the system:

Run Prime95 (CPU+RAM) for 30–60 minutes.
Run FurMark (GPU) for 15–30 minutes.
If no crash occurs, the fix is likely successful.

Frequently Asked Questions

powershell

# =============================================================
# SYSTEM_SERVICE_EXCEPTION (0x0000003B) - Diagnostic & Fix Script
# Run as Administrator in PowerShell
# =============================================================

Write-Host "=== Step 1: Check for recent BSOD minidumps ==="
$dumps = Get-ChildItem -Path "$env:SystemRoot\Minidump" -Filter "*.dmp" -ErrorAction SilentlyContinue
if ($dumps) {
    Write-Host "Found $($dumps.Count) minidump(s). Most recent:"
    $dumps | Sort-Object LastWriteTime -Descending | Select-Object -First 5 | Format-Table Name, LastWriteTime
} else {
    Write-Host "No minidumps found. Enable in Settings > System > About > Advanced System Settings > Startup and Recovery."
}

Write-Host ""
Write-Host "=== Step 2: Read last BSOD from Event Log ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,6008} -MaxEvents 10 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Id, Message | Format-List

Write-Host ""
Write-Host "=== Step 3: Run System File Checker ==="
Write-Host "Running SFC (this may take 10-15 minutes) ..."
sfc /scannow

Write-Host ""
Write-Host "=== Step 4: Run DISM to repair Windows image ==="
DISM /Online /Cleanup-Image /RestoreHealth

Write-Host ""
Write-Host "=== Step 5: Schedule CHKDSK on system drive ==="
$answer = Read-Host "Schedule CHKDSK on C: for next reboot? (y/n)"
if ($answer -eq 'y') {
    chkdsk C: /f /r /x
    Write-Host "CHKDSK scheduled. Reboot to run."
}

Write-Host ""
Write-Host "=== Step 6: Check RAM with Windows Memory Diagnostic ==="
$answer2 = Read-Host "Launch Windows Memory Diagnostic now? (y/n)"
if ($answer2 -eq 'y') {
    mdsched.exe
}

Write-Host ""
Write-Host "=== Step 7: List recently installed or modified drivers ==="
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Driver-Framework-UserMode-Reflector'} `
    -MaxEvents 20 -ErrorAction SilentlyContinue | Format-List TimeCreated, Message

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034,7035,7036,7040} `
    -MaxEvents 20 -ErrorAction SilentlyContinue | Format-List TimeCreated, Message

Write-Host ""
Write-Host "=== Step 8: Disable known problematic services (NDU) ==="
$answer3 = Read-Host "Disable the Network Data Usage (NDU) service as a test? (y/n)"
if ($answer3 -eq 'y') {
    Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Ndu' -Name Start -Value 4
    Write-Host "NDU service set to Disabled. Reboot to apply."
}

Write-Host ""
Write-Host "=== Step 9: List all third-party kernel drivers currently loaded ==="
fltmc filters
Write-Host ""
driverquery /v /fo csv | ConvertFrom-Csv | Where-Object { $_.State -eq 'Running' } |
    Select-Object 'Module Name','Display Name','Driver Type','Link Date' |
    Sort-Object 'Link Date' -Descending | Format-Table -AutoSize

Write-Host ""
Write-Host "=== Complete. Review output above and follow the deep-dive guide for your specific module. ==="

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, Windows kernel specialists, and SRE practitioners with 10+ years of experience diagnosing Windows kernel panics, BSOD stop codes, and system reliability failures across enterprise and consumer environments. Our guides combine WinDbg analysis, hands-on lab testing, and real-world incident data to deliver actionable, accurate troubleshooting steps.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.