Windows - NDIS.sys error

When a virus infection affects your system, the file named c:\windows\system32\drivers\ndis.sys gets removed by the virus scanner, generating a system error. This requires you to replace the ndis.sys file with a clean one from another machine into the folder named C:\WINDOWS\SYSTEM32\DRIVERS, before rebooting your computer, allowing the system to work properly again. As the NDIS.sys file cannot be replaced due to this error, BartPE needs to be used to boot the system. After booting, one must scan the whole computer using McAfee. The procedure may seem tough, but replacing the NDIS.sys file is essential.
Most viruses these days infect the c:\windows\system32\drivers\ndis.sys file! The file is usually removed by your virus scanner. JUST REPLACE THE NDIS.SYS FILE WITH A CLEAN ONE FROM ANOTHER MACHINE INTO THE C:\WINDOWS\SYSTEM32\DRIVERS FOLDER AND IT WILL WORK FINE AFTER A REBOOT.
If you can't replace the NDIS.sys file in Windows, then use BartPE to boot your system. You can get it from here:

I've also had the same problem and it is important to note:

The NDIS file in C:\Windows\System32\Drivers is the corrupt one. If you right-click on it and go to properties, there will be no version nr.


  • 1. Boot up with BartPe and scan for viruses using Mcafee (update defs before creating iso)
  • 2. Delete the NDIS.sys file in C:\Windows\System32\Drivers
  • 3. Copy the NDIS.sys file from D:\WINDOWS\ServicePackFiles\i386 to C:\Windows\System32\Drivers

Remove BartPE and Reboot.

Ask a question
CCM is a leading international tech website. Our content is written in collaboration with IT experts, under the direction of Jean-François Pillou, founder of CCM reaches more than 50 million unique visitors per month and is available in 11 languages.
This document, titled « Windows - NDIS.sys error », is available under the Creative Commons license. Any copy, reuse, or modification of the content should be sufficiently credited to CCM (