Windows - NDIS.sys error

December 2016

When a virus infection affects your system, the file named c:\windows\system32\drivers\ndis.sys gets removed by the virus scanner, generating a system error. This requires you to replace the ndis.sys file with a clean one from another machine into the folder named C:\WINDOWS\SYSTEM32\DRIVERS, before rebooting your computer, allowing the system to work properly again. As the NDIS.sys file cannot be replaced due to this error, BartPE needs to be used to boot the system. After booting, one must scan the whole computer using McAfee. The procedure may seem tough, but replacing the NDIS.sys file is essential.

Most viruses these days infect the c:\windows\system32\drivers\ndis.sys file! The file is usually removed by your virus scanner. JUST REPLACE THE NDIS.SYS FILE WITH A CLEAN ONE FROM ANOTHER MACHINE INTO THE C:\WINDOWS\SYSTEM32\DRIVERS FOLDER AND IT WILL WORK FINE AFTER A REBOOT.
If you can't replace the NDIS.sys file in Windows, then use BartPE to boot your system. You can get it from here:

http://www.nu2.nu/pebuilder/

I've also had the same problem and it is important to note:

The NDIS file in C:\Windows\System32\Drivers is the corrupt one. If you right-click on it and go to properties, there will be no version nr.

so...
  • 1. Boot up with BartPe and scan for viruses using Mcafee (update defs before creating iso)
  • 2. Delete the NDIS.sys file in C:\Windows\System32\Drivers
  • 3. Copy the NDIS.sys file from D:\WINDOWS\ServicePackFiles\i386 to C:\Windows\System32\Drivers


Remove BartPE and Reboot.

Related :

This document entitled « Windows - NDIS.sys error » from CCM (ccm.net) is made available under the Creative Commons license. You can copy, modify copies of this page, under the conditions stipulated by the license, as this note appears clearly.