Horizon Financial ServicesI recently had an issue where a clients PC had become infected with a virus which was quarantined by the anti-virus software. Great, only the files that were quarantined were the virus itself and an infected NDIS.sys file plus all other backup copies of this file on the PC eg “the dll cache”.
I copied the NDIS.sys file from another PC which I knew was clean and placed it in the c:\windows\system32\drivers directory thinking I soon would be back up and running but as soon as it was replaced I received the following STOP Error.
After a bit of head scratching and a walk around the office, I found that after booting into Safe Mobe that the registry key entry for NDIS was missing causing the STOP error. So I copied the key from the working XP PC and imported into the damaged PC and it rebooted just fine.
To do this just copy the text below into notepad and save the file as a .reg file then put it on a USB key and while in Safe Mode double click the file to import it into the registry and then reboot.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS]
“DisplayName”=”NDIS System Driver”
“ErrorControl”=dword:00000001
“Group”=”NDIS Wrapper”
“Start”=dword:00000000
“Type”=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\MediaTypes]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Parameters]
“ProcessorAffinityMask”=dword:ffffffff
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Enum]
“0″=”Root\\LEGACY_NDIS\\0000″
“Count”=dword:00000001
“NextInstance”=dword:00000001
Finally a solution for the problem I was struggling with all weekend. Have been reading all sort of articles on the internet to solve this same problem (also caused by an virus infection), but none of them worked for me. I was considering reinstalling my pc, but then I read this and as my last hope I tried it… And it did it for me! My networkadapters, Kaspersky etc. are all running normally again.
Many thanks for posting this!
Bas
My friend, thank you sincerely do not even know how to thank you, really saved my life.
Thank you very much, you’re a great professional
Thank you, thank you. I was struggling all week wtih this, and some of the suggestions from other sites actually made things worse! Your solution worked great, althouth for some reason I could not import the registry key, I had to enter it manually, but it still did the trick! The network adapters magically started working again! Thanks!
Dude, thank you very much. I had tried everything you can think to solve this problem!
I could not import the registry key as Janel, so I created the service an put it´s variables and all works fine.
Thanks!
Like Janel and Feco, I could not import the registry key as indicated. I went to a good PC, located the NDIS key, exported it to a .reg, then imported that into the bad PC. Worked.
I’m not finding anyone dealing with what caused this problem in the first place. Files don’t just disappear for no reason. For me it happened at the point that I did Windows updates. But I cannot prove that was the cause.
Thanks, that one had done the trick!
It just saved me a reinstall. And it was so simple
Excellent ,little gem hidden here.
Thankyou…worked for me.
Adam O
I have the same problem as Feco and janel. How and where do you input this manually?
Thanks,
Hi Marlton,
Manually entering the registry keys is not for the faint hearted, you need to go to Start, Run, and type “regedit”, browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. If the folder NDIS dosen’t exist you will need to create it by right clicking on the Services and selecting “New Key”.
Then name the key “NDIS” select this key and right click and select “New String Value”. Call it “Descrition”, double click it and in the section Value Data enter “NDIS System Driver”.
Then right click on the “NDIS” key again and create another “String Value” called “DisplayName” and give it the same Value Data as before.
Again create another “String Value” and call it “Group” with the Value Data “NDIS Wrapper”
And for the final “Expandable String Value” one called “ImagePath” with the Value Data of “system32\drivers\ndis.sys”
Now you need to create 3 DWORD (32-bit) Value Keys in the same way calling them “ErrorControl” with the Value Data of “3″ , “Start” with the Value Data of “0″ and “Type” with the Value “1″.
Then create another KEY as with the “NDIS” Key under the “NDIS” key called MediaTypes
And another Key “Parameters”. Right click on this and create a “New DWORD-32bit” called “ProcessorAffinityMask” with the Value Data “ffffffff”.
Now make another Key under “NDIS” called “Enum” and create new “String Value” with the name “0″ and Value “Root\LEGACY_NDIS\0000″
Another DWORD 32bit with the name “Count” and Value “1″
and last a DWORD 32bit with the name “NextInstance” and Value “1″
Once created restart the PC and if the entries are correct and the ndis.sys file in the right location then it should be fixed.
Always Backup the registry before doing anything to it by right clicking the “Computer” at the top and selecting “Export” and save it.
Sorry for the long winded answer.
Hey Admin,
You are a legend. I am not very technical and have both looked at and tried many solutions to this problem but nothing worked. I followed your instructions above and hey presto I’m back in business.
Thank you so much for taking the time to help me on this.
Eternally grateful
Marlton
The import of the .reg file will obviously fail because it’s lacking “REGEDIT 4″ at the very beginning that instructs the parser that it’s a valid registry script file.
However, thank you for posting the export of a known good one for those of us with no access to spare XP boxes.
Cheers.
I will check the syntax a few people have had trouble with it so I will look into it.
Thanks
I saw NDIS.sys in my quarantaine. A search on the internet with another computer and yes this site gave the solution. Hallelujah.