Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Bug Check 0x3B, also shown as SYSTEM_SERVICE_EXCEPTION, means Windows encountered an exception while code was transitioning from a less-privileged process to the kernel. Start by undoing recent driver, service, and hardware changes, then use Safe Mode and Windows’ diagnostic tools. If the blue screen returns, preserve the crash dump and inspect it with WinDbg; the stop code and any module named under “What failed” are evidence, not a complete diagnosis.
What Bug Check 0x3B means
Microsoft assigns the value 0x0000003B to SYSTEM_SERVICE_EXCEPTION. A system-service transition occurs when ordinary application code requests an operation that must run in privileged Windows code. The bug check is raised when that transition encounters an exception that the kernel cannot safely handle.
As an Amazon Associate I earn from qualifying purchases.
The underlying exception can be a null-pointer dereference, an access to an invalid address, memory that was released too early, or corruption in a data structure. Those possibilities explain why the same stop code can be produced by different drivers, services, memory faults, or other kernel-mode failures. The number alone does not prove that Windows itself, the module printed on the blue screen, or one vendor is solely at fault.
| Parameter | What it identifies | How it helps |
|---|---|---|
| 1 | Exception code | Shows the specific exception that occurred. |
| 2 | Address of the instruction that caused the exception | Provides the faulting location for dump analysis. |
| 3 | Address of the exception context record | Used with WinDbg’s .cxr command to restore the relevant register and stack context. |
| 4 | Unused value | Does not add diagnostic information for this bug check. |
A common first parameter is 0xC0000005, STATUS_ACCESS_VIOLATION, which means an instruction referenced memory it was not allowed to use. Microsoft also lists 0x80000003, STATUS_BREAKPOINT, among possible exception codes. These are examples of exception types, not a ranking of how often they occur.
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
Why the crash may name win32k.sys, nvlddmkm.sys, or another file
The blue screen may display a line such as “What failed: win32k.sys” or “What failed: nvlddmkm.sys.” Treat that name as a lead to investigate. The module may have been executing when corrupted data reached it, while the original error was introduced by another driver, faulty memory, or a service that interacted with it. A displayed filename is therefore not conclusive proof that replacing or deleting that file will fix the computer.
Record the exact filename, capitalization, and any driver version shown in the crash screen or dump. Keep that information with the stop code and the time of each failure. A repeated filename is useful when it matches a recent driver or hardware change, but it still needs confirmation from the stack and exception context.
First-response checklist
Use the least disruptive checks first. They are reversible and often reveal the trigger without creating another crash.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Write down the complete stop information. Record
SYSTEM_SERVICE_EXCEPTION,0x3B, the four parameter values if visible, the “What failed” module, and when the crash occurred. Photograph the screen if Windows restarts too quickly. - Undo the most recent software change. If the crashes began after a device-driver installation, driver update, system service, utility, or similar change, remove it or roll it back using its supported uninstaller or Device Manager. Reboot and test before changing anything else.
- Inspect Device Manager. Open Device Manager and look for warning icons. For a recently changed device, open its properties and review the driver provider, date, and version. Roll back the driver when that option is available, or reinstall the previous known-good package supplied for the exact Windows edition and device.
- Review the System log. In Event Viewer, open Windows Logs and then System. Filter or scroll to the period immediately before the blue screen. Note device, service, storage, or kernel events that recur at the same time; an event is a clue, not a diagnosis by itself.
- Disconnect recently added hardware. Shut down completely, remove the newly installed device, or return it to its previous configuration. If removal is not practical, check the manufacturer for firmware and driver updates that specifically support your Windows version. Test with the machine in the configuration that was stable before the crashes.
- Stop making unrelated changes. Do not replace every module named on successive blue screens or install several driver packages at once. Changing many variables removes the evidence needed to identify the original fault.
- Preserve crash dumps. If Windows creates a dump after a crash, copy it to another drive before running cleanup utilities or reinstalling software. Keep several dumps from different incidents so a debugger can show whether the same instruction, driver, or pattern recurs.
If Windows will not restart normally: use Safe Mode
Safe Mode loads a limited Windows environment and is useful when a normal startup crashes before you can inspect drivers or logs. If the computer cannot remain running long enough to reach the desktop, enter the Windows Recovery Environment by interrupting startup two or three times, or by using installation or recovery media. Choose Troubleshoot, Advanced options, Startup Settings, and Restart; then select the Safe Mode option shown on screen (usually 4 for Safe Mode or 5 for Safe Mode with Networking).
Once in Safe Mode, remove or roll back the newest driver or service, disconnect newly installed hardware, and copy any dump files. Check Device Manager for warning icons and Event Viewer’s System log. Restart normally after each focused change. A machine that is stable only in Safe Mode points toward something omitted from that limited startup, but it does not by itself identify which component is responsible.
If Safe Mode also crashes, hardware or lower-level corruption becomes more concerning. Avoid repeatedly forcing normal boots; concentrate on preserving dumps and testing memory before making broad software changes.
Use WinDbg to identify the failing path
WinDbg is Microsoft’s debugger for crash dumps and live user-mode or kernel-mode debugging. Current installation routes include the direct installer, the Microsoft Store, and winget. Install it on a working Windows session, then open the preserved kernel dump rather than attempting to debug while the affected system is repeatedly crashing.
For a 0x3B dump, the parameter values on the bug-check screen or in the dump are important. Parameter 3 is the context-record address that the Microsoft workflow uses with .cxr. After loading the dump, run the commands below in the command window, substituting the recorded value where indicated.
| Command | Purpose | What to record |
|---|---|---|
.cxr <parameter-3-address> |
Displays the exception context and makes that context active for subsequent inspection. | The register state and any instruction address that WinDbg reports. |
kb |
Shows the stack backtrace for the active context. | The call sequence, especially third-party modules near the fault. |
!error <exception-code> |
Interprets the NTSTATUS exception code, such as 0xC0000005. |
The textual meaning and severity of the exception. |
lm t n |
Lists loaded modules with timestamps and names. | Driver names and versions that were loaded when the crash occurred. |
On some dumps, the debugger exposes KiBugCheckDriver, which can reveal a driver name associated with the bug check. Use that result together with the backtrace and loaded-module list. If the stack points only to a Windows component, do not conclude that Windows is defective: the component may be where earlier memory corruption became visible.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Save the WinDbg output with the dump’s date and the hardware or driver configuration at that time. Comparing two or more dumps is more informative than treating one stack frame as a verdict. Consistent evidence—such as the same third-party module, the same instruction, and the same exception type—supports a focused rollback or update. Changing modules and exception codes across crashes suggests that the first visible module may be a victim of broader corruption.
Run Driver Verifier carefully
Driver Verifier is built into Windows and examines driver behavior in real time, including memory-resource use. It can expose a driver that behaves incorrectly, but verification adds overhead and can deliberately trigger a stop error to capture evidence. Use it only after recording the original dumps and narrowing the suspect list.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Open the Driver Verifier manager by searching for Driver Verifier from Start.
- Create the standard verification settings, then choose the option that lets you select driver names from a list.
- Select the smallest practical set of non-Microsoft drivers connected with the recent change or the WinDbg evidence. Do not select every driver simply because the machine has many of them.
- Restart and use the computer normally enough to reproduce the failure. Record the new stop code and preserve the resulting dump.
- After collecting evidence, turn verification off. In an elevated Command Prompt, run
verifier /reset, then restart. If Windows cannot boot normally, enter Safe Mode and run the same reset command there.
Because Verifier can make an unstable driver crash sooner, it is a diagnostic test rather than a permanent performance setting. If the system becomes unusable immediately after enabling it, return to Safe Mode, reset verification, and continue with dump analysis or memory testing instead of adding more drivers to the verification list.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check physical memory when the evidence keeps changing
Microsoft’s general stop-error guidance includes Windows Memory Diagnostic when physical memory is suspected. Search for Windows Memory Diagnostic, choose the option to restart and check immediately, and let the test complete before Windows loads. Follow up on any reported errors by testing the machine with the manufacturer’s recommended memory configuration and by checking compatible firmware or hardware guidance.
Changing symptoms matter. If one dump names a graphics-related module, the next names an unrelated storage or networking module, and the exception codes vary, repeatedly replacing the named drivers is unlikely to be a sound strategy. That pattern is a reason to investigate memory corruption or hardware instability, while still checking recent driver and service changes.
Which remedy should you try first?
| Remedy | Safety and reversibility | Diagnostic depth | Typical time | Can it trigger another crash? |
|---|---|---|---|---|
| Undo a recent driver or service change | High; rollback or uninstall can usually be reversed | Moderate; tests a strong timing correlation | Minutes to an hour | Normally no, unless the removed component was required for another device |
| Remove recently added hardware | High when the device is externally removable and the system is powered off | Moderate; isolates a recent physical change | Minutes to several hours | No during the test, although firmware or cabling problems may remain |
| Safe Mode and Event Viewer | High; uses built-in recovery and logs | Moderate; narrows startup components and timing | 30 minutes to several hours | Low |
| WinDbg dump analysis | High; analyzes preserved evidence without changing drivers | High; exposes context, stack, exception, and loaded modules | About an hour for one dump; longer for comparisons | No |
| Driver Verifier | Lower; verification adds overhead and may force a bug check | High for a narrowed driver set | Minutes to a day of normal use | Yes, by design when a verified driver violates rules |
| Windows Memory Diagnostic | High; it tests memory rather than changing drivers | Moderate for physical-memory faults | One or more restarts, depending on capacity | It can reveal instability during the test, but it is not intended to alter the system |
For a single crash immediately after a known driver change, begin with rollback and log review. For recurring crashes with no obvious change, preserve dumps and use WinDbg. Reserve Driver Verifier for a short, targeted investigation, and use memory testing when the implicated modules change from crash to crash.
Recommended Free Tools
How to decide whether a fix worked
After each change, use the computer under the same workload that previously produced the blue screen. Keep a dated record of the driver or hardware state, the stop code, the named module, and whether a new dump was created. A successful result is not merely one clean reboot; confidence increases when the original workload remains stable and subsequent dumps stop showing the same evidence.
If a rollback stops the crashes, keep the older driver or configuration until the manufacturer publishes a version that addresses the problem. If an update is necessary, install only the package intended for the exact device and Windows edition, then test before making another change.
When to escalate the diagnosis
- Escalate to the device or system manufacturer when the failure began after hardware installation, firmware changes, or a driver supplied for a specific model and the problem remains after returning to the prior configuration.
- Provide a technician with evidence, not just the number. Include the stop code, all four parameters, every “What failed” filename, WinDbg’s
.cxr,kb,!error, andlm t noutput, Event Viewer entries around the crash, and memory-test results. - Consider hardware-focused service when memory testing reports errors or when different crashes implicate changing modules despite stable software and driver versions.
Do not delete or overwrite dumps before copying them, and do not leave Driver Verifier enabled after the diagnostic window. Those two practices preserve the evidence and reduce the chance that a troubleshooting test becomes a new source of instability.
Quick Recap
Optional shortcut
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, including broken system elements, invalid redirects, shared DLL files, settings that increase CPU, RAM, or disk load, and temporary or cache files. It also includes privacy and vulnerability checks, a real-time boost, file shredder, and app-crash log, and runs on Windows 11, 10, 8, and 7. A free trial by category lasts at least two days before a paid subscription; results vary, it complements antivirus software rather than replacing it, and no tool repairs every crash.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
