STOP CODE · 0x3B
SYSTEM_
A program asked Windows to do something, and an error happened in the privileged code that handled the request. That code includes drivers, and the screen may name a driver's file.
WHAT MICROSOFT SAYS
Microsoft's reference says this bug check "indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code", which can happen because an empty pointer or a random incorrect address was used, in turn caused by memory being freed too early or by data structure corruption. Its general steps start with device drivers and system services added recently.
From Microsoft's documentation, linked under Sources. Microsoft wrote its page for this code for programmers; the steps below are the ones it gives everyone else.
TECHNICAL SUMMARY
| Stop code | SYSTEM_SERVICE_EXCEPTION |
|---|---|
| Value | 0x0000003B (0x3B) |
| Where you see it | At the bottom of the stop screen, and in the System event log after the restart |
| In Tweaky Driver | Stop codes are not read; driver versions are checked |
What causes SYSTEM_
- Privileged code used an empty pointer or a wrong address.
- Memory was freed too early, or a data structure was corrupted.
- A device driver or system service added shortly before the first crash.
- Hardware added recently.
How to fix SYSTEM_
The steps come from Microsoft's guidance, with the reversible ones first. Each one says how to put back what it changed. If Windows cannot start normally, Microsoft's basic steps say to start in safe mode and continue from there.
Write down the stop code and the file the screen names
Microsoft Support says the stop code appears at the bottom of the screen and, when Windows knows it, so does the name of the module that was running. If the screen went by too fast, the command under Check it yourself lists the stop codes Windows recorded, and Event Viewer > Windows Logs > System shows the errors logged around the restart.
To undo: Nothing to undo: this only reads information.
Before you change anything: note the driver and make a restore point
Open the device's Properties > Driver tab and write down the driver provider, date and version. Then select Start, type Create a restore point, open it, and on the System Protection tab choose Create. Microsoft notes that System Protection is not turned on by default; if Create is greyed out, choose Configure and turn it on for the system drive first.
To undo: A restore point changes nothing by itself. To go back later, run System Restore and pick it: Microsoft says it reverts system files, the registry and installed programs, and leaves your personal files alone.
Take out what you added just before it started
Microsoft's first basic step for a stop code that keeps coming back is to remove new hardware: shut the PC down, disconnect the device and start again. Its bug check pages say the same about drivers and system services added recently: remove or update them, and work out what changed just before the first crash.
To undo: Reconnect the hardware, or install the program or driver again.
Look for a warning icon in Device Manager
Right-click Start and open Device Manager. Microsoft's steps: see whether any device is marked with an exclamation point, right-click it and choose Update driver; if updating does not help, try disabling or uninstalling the device. The code shown in the device's Properties has its own page in our Device Manager section.
To undo: Roll Back Driver returns to the previous driver, a disabled device is enabled again from the same right-click menu, and an uninstalled one comes back with Action > Scan for hardware changes.
Update the driver the screen names
Microsoft's advice when a driver is identified in the bug check message is to disable the driver or check with the manufacturer for driver updates. In Device Manager, right-click the device and choose Update driver, or install the current package from the manufacturer's support page for your exact model.
To undo: Open the device's Properties > Driver tab and choose Roll Back Driver, or apply the restore point.
If it started after a driver update, roll the driver back
In Device Manager, right-click the device, choose Properties, open the Driver tab and select Roll Back Driver, then give a reason and confirm. Microsoft notes that you need administrator rights, and that going back to the previous driver often fixes a problem that appeared after an update. The button is greyed out when Windows kept no earlier driver for the device.
To undo: Rolling back is the undo for the update. To return to the newer driver, install it again with Update driver or from the manufacturer's package.
Install the latest Windows updates
Select Start > Settings > Windows Update and choose Check for updates. It is one of Microsoft's basic steps for a stop code that keeps returning, and it is how new versions of Windows' own drivers arrive.
To undo: If the crashes get worse after an update, apply the restore point from the earlier step.
If nothing helps, go back to a restore point
Microsoft's last basic step is to restore Windows from a system restore point made before the crashes began, or to use one of its other recovery options.
To undo: System Restore leaves personal files alone; programs and drivers installed after that restore point have to be installed again.
Check it yourself
List the stop codes Windows recorded (PowerShell)
Each entry gives the date, the stop code as a hexadecimal number with its four parameters, and where the dump file was saved. On the test PC, Windows 11 build 26300, this ran without administrator rights. An error saying no events were found means Windows recorded none. This stop code appears there as 0x0000003b.
PowerShellGet-WinEvent -FilterHashtable @{ LogName='System'; Id=1001; ProviderName='Microsoft-Windows-WER-SystemErrorReporting' } -MaxEvents 5 | Format-List TimeCreated, MessageList the driver packages installed on the PC
Shows every third-party driver package with its provider, class, version and date, so you can see what was installed around the first crash. Nothing is changed.
cmdpnputil /enum-drivers
What Tweaky Driver can and cannot do here
Driver version checkTweaky Driver does not read crash dumps or stop codes, so it cannot tell you which driver caused this screen. It helps with the step that comes after Windows names a driver: its scan lists every device with the installed driver version and shows whether Windows Update, the Microsoft Update Catalog or a manufacturer package it supports has a newer one, with the source and version in front of you before anything is installed. A newer driver is no promise that the blue screen stops: the same code can come from hardware or from Windows itself.
Tweaky Driver, the driver checker that shows its sources — free for Windows 10 and 11.
Common questions
What does SYSTEM_SERVICE_EXCEPTION mean?
An exception happened while Windows was running a routine that moves from non-privileged code to privileged code: the point where a program's request is handed to the kernel.
What does SYSTEM_SERVICE_EXCEPTION with a .sys file mean?
The file is the module Windows identified. If it is a vendor's driver, update or roll back that device's driver. If it is a Windows file, keep in mind Microsoft's analysis of crash root causes: 70% third-party driver code, 10% hardware, 5% Microsoft code and 15% unknown.
Does this stop code mean a Windows service crashed?
No. The code is about a routine that passes from non-privileged to privileged code, not about an entry in the Services list.