SYSTEM: ONLINE
THREAT FEED: LIVE
LAST SCAN: October 9, 2026
247plan_net
Article · 247plan

SYSTEM_SERVICE_EXCEPTION: What It Means and How to Fix It

By Ryan Cole · October 9, 2026 · 9 min read

Quick answer: The SYSTEM_SERVICE_EXCEPTION blue screen (stop code 0x0000003B) means something crashed inside the Windows kernel while it was servicing a request from an ordinary program. On Windows 11 and Windows 10 the cause is a bad or outdated driver far more often than anything else, so look for the .sys file named on the crash screen or in the dump, update or roll back that driver, and uninstall any third-party antivirus or VPN you added recently. If no driver is named, run sfc /scannow and DISM, then test the RAM and the drive.

Every time an app on your PC wants to do something real, like read a file, talk to the network or draw a window, it asks the kernel to do it on its behalf. That handoff is called a system service call. It happens thousands of times a second and you never see it.

SYSTEM_SERVICE_EXCEPTION is what you see when one of those handoffs blows up. Code running with full kernel privileges hit an error it could not handle, and Windows pulled the plug before the damage could spread. The program that made the request is almost never to blame. The code that crashed is usually a driver, which is a small piece of third-party software that runs with the same privileges as Windows itself.

That is good news. Drivers are replaceable. This stop code is annoying, but it is one of the more fixable blue screens.

If the stop code on your screen is a different one, the Windows stop code lookup explains what the common ones mean and where to start. If the codes keep changing from crash to crash, read the laptop blue screen guide first, because rotating codes point at hardware.

Read the screen before it disappears

The blue screen (on newer Windows 11 builds, a simpler black screen) shows the stop code at the bottom. Sometimes it also shows a line that reads What failed: followed by a file name. That file name is the single most useful clue you will get.

A few names come up again and again with this stop code:

If the screen named nothing, or the machine rebooted too fast to read it, the information is still on disk.

Step 1: Find the faulting driver in the crash dump

Windows writes a small memory dump for every blue screen into C:\Windows\Minidump. Two free tools read them.

BlueScreenView from NirSoft is the quick one. Open it and it lists every recorded crash with the bug check code and the drivers that were on the stack, highlighted in pink. Look for a driver that appears across several crashes.

WinDbg from the Microsoft Store goes deeper. Open a dump file, type !analyze -v, and read the MODULE_NAME and IMAGE_NAME lines near the bottom.

While you are there, note the first parameter of the bug check. A value of 0xC0000005 means an access violation, which is the classic signature of a driver reading memory it does not own.

One crash naming a driver is a hint. Three crashes naming the same driver is a diagnosis.

Step 2: If you cannot boot normally, use Safe Mode

If the crash happens at startup or within a minute of logging in, you need Safe Mode, which loads Windows with a minimal set of drivers.

From the sign-in screen, hold Shift and choose Power, then Restart. If Windows will not get that far, interrupt the boot three times in a row (power off as the logo appears) and Windows opens the recovery environment on its own. From there go to Troubleshoot, Advanced options, Startup Settings, Restart, and press 5 for Safe Mode with Networking.

If the crashes stop in Safe Mode, that is strong evidence for a third-party driver or startup program, because Safe Mode does not load them.

Step 3: Update or roll back the driver

What you do depends on timing.

If the crashes began right after a driver or Windows update, roll back. Open Device Manager, find the device (graphics cards are under Display adapters), right-click, Properties, Driver, Roll Back Driver. If the button is greyed out, uninstall the device with the box ticked to delete the driver, then install the previous version from the manufacturer's site.

If the driver is old, update it, but from the right source. For graphics, go to NVIDIA, AMD or Intel directly. For laptops, the laptop maker's support page often has drivers tuned for that model, and those are the safer choice for audio, chipset and touchpad drivers. Avoid "driver updater" utilities that promise to update everything at once. They install the wrong versions often enough to cause exactly this crash.

For graphics drivers specifically, a clean install fixes problems that a normal update leaves in place. NVIDIA's installer has a clean installation option, and AMD's has a factory reset option. If that still fails, Display Driver Uninstaller (DDU), run from Safe Mode, strips every trace of the old driver before you reinstall.

Step 4: Remove kernel-level security and network software

Third-party antivirus suites, VPN clients, firewalls, game anti-cheat systems and some RGB lighting or fan control utilities all install kernel drivers. Any of them can produce SYSTEM_SERVICE_EXCEPTION, especially after a Windows feature update changes something they hook into.

If you installed one of these around the time the crashes began, uninstall it with the vendor's own removal tool rather than the normal uninstaller, which often leaves the driver behind. Then run for a day or two.

You will not be unprotected while you test. Removing third-party antivirus hands protection back to Microsoft Defender automatically, and Defender is a perfectly good antivirus for most people. Our guide to the Windows Defender settings worth turning on takes five minutes and closes the gaps that ship switched off.

The same goes for VPN software. If a VPN driver is the culprit, check for a newer client version before you give up on it. If you need a replacement, NordVPN maintains a current Windows 11 client, but do not switch providers until the crash dumps actually point at the VPN driver.

Step 5: Repair Windows system files

If no third-party driver stands out, or the dumps keep naming Windows files like win32kfull.sys, repair the operating system itself. Open Terminal (Admin) and run:

sfc /scannow

When that finishes, run:

DISM /Online /Cleanup-Image /RestoreHealth

Reboot and run sfc /scannow once more. SFC repairs system files from a local store, and DISM repairs that store from Windows Update. In that order they catch corruption that either one alone would miss.

If the crashes started after a specific Windows update, you can also remove it: Settings, Windows Update, Update history, Uninstall updates. Do that only as a test. Leaving a machine unpatched long term is a worse problem than the blue screen.

Step 6: Rule out memory and disk

Bad RAM can corrupt the code a driver is running and make a healthy driver look guilty. If the dumps name a different driver every time, test the memory. Press Windows + R, run mdsched.exe, and let it restart and check. For a proper stress test, run MemTest86 from a USB stick for at least four passes. Our MEMORY_MANAGEMENT guide covers the full RAM testing process, including what to buy if a stick fails.

For the drive, run chkdsk C: /scan from an admin terminal, and check the SMART health with a free tool such as CrystalDiskInfo. A drive reporting reallocated or pending sectors should be backed up today and replaced soon. A 1TB or 2TB NVMe SSD is the standard replacement for most desktops and laptops built in the last six years. Confirm your slot type before you order.

Step 7: Update the BIOS and check for malware

Motherboard and laptop makers ship BIOS updates that fix power management and compatibility bugs, some of which show up as kernel crashes. Download the update only from the manufacturer's support page for your exact model, plug a laptop into the wall, and do not interrupt it.

Malware is a rare cause of this stop code, but rootkits do load their own kernel drivers. If you see a driver name in the dumps that you cannot identify and cannot find online, run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options). For a second opinion from a different engine, Iolo Malware Killer runs alongside Defender as an on-demand scanner. Buy it for that purpose only. It will not fix a buggy graphics driver.

When to stop

If you have clean drivers, clean memory tests, a healthy drive, repaired system files and the crash still returns, back up your files and use Settings, System, Recovery, Reset this PC. If SYSTEM_SERVICE_EXCEPTION survives a full reset with nothing reinstalled, the problem is hardware, and it is time for a repair shop or a warranty claim.

Frequently Asked Questions

What causes SYSTEM_SERVICE_EXCEPTION on Windows 11?

Most often a faulty, outdated or incompatible driver, with graphics, antivirus, VPN, webcam and audio drivers the usual suspects. Corrupted system files, failing RAM, a bad drive and outdated BIOS firmware are less common causes. The file named on the crash screen or in the minidump is the fastest way to tell which one you are dealing with.

Is SYSTEM_SERVICE_EXCEPTION a virus?

Rarely. The stop code itself is generated by Windows, not by malware, and the overwhelming majority of cases are driver bugs. Malware becomes a suspect only when the crash dumps name a driver you cannot identify. A Microsoft Defender Offline scan is the right first check in that case.

Can SYSTEM_SERVICE_EXCEPTION damage my computer?

The crash itself does not damage hardware. Windows stops deliberately to prevent damage. The risk is to open files, which can be lost or corrupted at the moment of the crash, so back up important work while you troubleshoot.

What does ks.sys mean in a SYSTEM_SERVICE_EXCEPTION crash?

ks.sys is the Windows kernel streaming driver used by cameras, capture cards and audio devices. When it appears, the real cause is usually a webcam driver, a virtual camera from video conferencing or streaming software, or a capture device. Update or remove that software first.

Should I use Driver Verifier?

Only if the dumps do not identify a driver and you are comfortable with recovery mode. Driver Verifier deliberately stresses drivers so a bad one crashes and identifies itself, which means it can cause boot loops. Create a restore point first, and know how to turn it off from Safe Mode with verifier /reset.