Code 39 error on network cards due to virus [Solved/Closed]

Iain - Apr 13, 2009 at 05:04 PM - Latest reply:  Granit
- Jan 24, 2013 at 07:56 AM
Hello,

I wonder if someone could help me? I recently had some virus trouble on my PC, and for some reason now I cannot access the internet as all my network adaptors all come up with an icon (yellow circle and black exclamation mark). On checking this it says that this is a code 39 error and that the driver may be missing or corrupted.

I have tried uninstalling the adaptor software and reinstalling it, but it still comes up with the same message. The same thing happened when I added a new adaptor to my PC.

Is there anything else that I can do do try and rectify this issue and get connection to the internet?

Hope someone can help,

Iain
See more 

51 replies

Best answer
34
Thank you
I was working on an XP machine that was very badly infected. I cleaned up the infection, and the machine was fine except for that all networking devices were not working with Code 39. I ran sfc /purgecache, which was successful, all files checked out with sfc /scannow, but the cards still did not show up. It turned out that ndis.sys was totally missing from C:\WINDOWS\system32\drivers, and copying in the file from another XP installation fixed the problem. I suppose the Code 39 error was due to the missing NDIS wrapper in ndis.sys, not problems with the networking drivers themselves.

Thank you, Steve 34

Something to say? Add comment

CCM has helped 1916 users this month

Thank you SOOO much! I was just about to reformat when I decided to Google the issue one last time. This saved me the headache of reformatting & having to reinstall all the user's programs!!
Thanks for this got me out of a lot of bother
Thanks for your information.... ur really hepling me to solved this problem..
Thank you very very much.......
aspperasp 6 Posts Sunday November 11, 2012Registration date December 16, 2012 Last seen - Dec 16, 2012 at 10:41 PM
Thanks, Steve, this helps a lot.
dude you saved me 2-3 days of work and a nervous breakdown
13
Thank you
i'm with a same problem! =/
how dd you fix it?
very same problem, does anyone have solution?
11
Thank you
If you still have an issue with booting into normal windows mode afer copying ndis.sys to c:/windows/system32/drivers/ndis.sys, means you are missing registry entry for this file. So 1 more step required.
Have to copy it from good computer with same OS.
Or use mine (XP sp3 pasted below, no editing needed). Save this as a *.reg file with notepad and after opening it will add it to your registry, good luck, worked for me:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS]
"DisplayName"="NDIS System Driver"
"ErrorControl"=dword:00000001
"Group"="NDIS Wrapper"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\MediaTypes]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Parameters]
"ProcessorAffinityMask"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Enum]
"0"="Root\\LEGACY_NDIS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS\0000]
"Service"="NDIS"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000020
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="NDIS System Driver"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS\0000\Control]
"ActiveService"="NDIS"
After copying a good ndis.sys in c:/windows/system32/drivers/ndis.sys, my computer would not start but in "Safe Mode". Hence, I am trying your (test2004 May 14, 2010 1:116pm BST post) extra step. All the entries but the ones with [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS...]
are already in my registry. Trying to use your script to add these extra entries is not working at all - I get "Cannot import C:\x.reg: Error accessing the registry". (I can do other changes using regedit hence, permissions are not the issue.) Could you please advice how to add these missing entries by hand in the registry?
THANKS!
this worked aok for me, replaced ndis.sys, imported reg file in safe mode and all is good again
Hi, I am in a boot loop now but can get in to Windows through safe mode after replacing the ndis.sys file from a good XP machine.
I now have tried running your .reg command above but I get the message

"Cannot import .reg. The specified file is not a registry script/ You can only import binary registry files form within the registry editor"

What can I do?
I just did this. Can't believe it worked after wasting 2 days. Thank you.
Wasted 4 freaking days here - you guys are a godsend!! I swear this virus just won't give up. I thought I had it beat, then installed MSFT security suite, and it came back - apparently due to an attempted cleaning of the 'ndis.sys' file!

Thank you, thank you - THANK YOU!!
9
Thank you
PROBLEM SOLVED:


Most viruses these days infect the c:\windows\system32\drivers\ndis.sys file! the file is usually removed by your virus scanner. JUST REPLACE THE NDIS.SYS FILE WITH A CLEAN ONE FROM ANOTHER MACHINE INTO THE C:\WINDOWS\SYSTEM32\DRIVERS FOLDER AND IT WILL WORK FINE AFTER A REBOOT. ALL YELLOW EXCLAMATION MARKS JUST DISAPEAR. I HAVE HAD TO DO THIS MANY TIMES!!!
6
Thank you
i had this error but I think I fixed it

first get all viruses off pc than start looking into ndis.sys

http://www.hardwareanalysis.com/content/topic/41945/

if it is missing in your drivers folder find a version of xp & copy it from there as soon as I copied it to my drivers I got a virus quar that killed a liked named virus in the dllcache folder sytem32/dllcache/ndis.sys is a virus <------


hope this helps it did for me now im trying to fix the other problems I created fking with the registry


Eli
3
Thank you
as Eli wrote...
use command line (press WIN+R, type CMD and then press ENTER). here write
"sfc /PURGECACHE" without quotes (this will remove DLLCHACHE folder C:\windows\system32\dllcache )

if error 0x00000005 appear (access denied), download program UNLOCKER (use google to find it) and install it, press right button on ndis.sys and select UNLOCKER. select DELETE and push OK button. then after some seconds appear question "Remove after restart?", push YES.

do same on file ndis.sys located in folder C:\windows\system32\drivers

restart.

after restart run "sfc /PURGECACHE" without quotes again. if no error appear, you are almost done.
run "sfc /SCANNOW" without quotes to chceck originality of windows files. it maybe executed automaticaly on system start.
chceck both ndis.sys files like this: click on PROPERTIES and you must see a VERSION card. otherwise virus is still present, file is infected. DELETE again both files, repeat steps described above...

and sorry for my English, I am Slovak...
lsi-92 2 Posts Saturday May 22, 2010Registration date May 22, 2010 Last seen - May 22, 2010 at 09:28 PM
3
Thank you
Thanks test2004, here's the last bit of goodness needed to fix this...

To add subkeys to the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root key, you must first give yourself permissions to edit the key:

1. Open REGEDIT
2. go to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\
3. in the left pane, right-click the "root" key
4. click permissions
5. click the Add button
6. type "Administrator" into the box, then click OK
7. click Administrator (once)
8. in the Permissions for Administrator panel, in the Allow column, tick the box [ ] Full Control
9. click OK

Now, subkeys can be imported by Administrator to the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root key. Double-click a valid .REG file to import. REGEDIT should update the screen automatically.

Once the import is successful, remove the permissions you just added:

1. Open REGEDIT (if not already open)
2. go to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\
3. in the left pane, right-click the "root" key
4. click permissions
5. click Administrator (once)
6. click the Remove button
7. click OK

Note, I think that the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key is a mirror of one of the HKEY_LOCAL_MACHINE\SYSTEM\ControlSetXXX keys (where XXX is a number). In my testing, I did not need to add to the "CurrentControlSet" key, it was auto-updated when I added the key to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001.

Note, the key should be added to ControlSet002, ControlSet003 etc if they exist.

Once all the keys have been added, and permissions reset back to normal, reboot.

Assuming you were trying to fix a blue-screen/reboot following replacing NDIS.SYS, and your system was otherwise OK, you should now find that you can login in normal mode.
Thanks! This extra step resolved the ndis.sys problem for me.
Have a nice weekend!

Garden
ROCK AND ROLL!!! Thanks for this last little bit of info, it got me back up and working!
2
Thank you
I had the same problem, all network card drivers were showing up with a yellow exclamation mark in device mananger after a reboot. I've tried running the sfc commands as described by Eli, but that didn't solve the problem. When I went to check ndis.sys file, it turned out that it wasn't there. The SFC /scannow command did not restore the file. Neither did re-applying the latest Windows service pack.

For me, simply copying the file from C:\WINDOWS\ServicePackFiles to C:\WINDOWS\system32\drivers and rebooting the PC resolved the problem.
hey, can you tell me in which folder ndis.sys should present? I have the same problem with yellow exclamation mark.
That was one fine piece of advice. It worked. Thanks - BIG Time.
2
Thank you
Here's a good overview of the Code 39 error and what to do about it:

http://pcsupport.about.com/od/findbyerrormessage/a/code-39-error.htm

There's nothing specific on the blue screen you got but as far as the device manager error, this page has some good steps. I had a 39 error on my keyboard and this advice helped me take care of it.
1
Thank you
As I haven't registered, I don't seem to be able to edit my message, but I felt I should mention that I also had to boot up again after adding the file.
1
Thank you
HEY!!!!! Replacing the ndis.sys file worked PERFECTLY for me. Im using HP pavilion DV2000 Windows xp sp3. Thank you guys!!!!!!!! You made me feel happy I was frustrated for many days ...... god bless you

Greetings from mexico
1
Thank you
Just wanted to give a final update on my end: I finally solved the problem of replacing the "ndis.sys" file and avoiding the blue-screen, failed startup. You see, every time I tried copying a new, clean ndis.sys file (from various places and other WinXP machines) into the 'drivers' folder, I would try to reboot but could only startup Windows in Safe Mode. So I would have to remove the same 'clean' ndis.sys file that I just copied into there so I could load Windows normally. But that put me back at square one with all of my network connections on code 39 error, and additionally my graphics card was showing an error 10 - "device could not start." Ugh, absolutely frustrating.

I simply left out the "ndis.sys" file from Windows\system32\drivers\ and used Windows "System Restore" utility to restore my laptop to its original settings that were in place a few days before the virus wreaked havoc on my system. I rebooted and everything was like new! The system restore even restored the missing "ndis.sys" file on its own...SUCCESS! Anyway, I found this thread and everyone's input here very helpful in leading me to solve the issue. Thanks everyone!
it was exactly the same as for me except that I can not restore my XP! what to do ?
1
Thank you
If you can't replace the NDIS.sys file in windows then use BartPE to boot your system. You can get it from here:
http://www.nu2.nu/pebuilder/

I've also had the same problem and it is important to note:

The NDIS file in C:\Windows\System32\Drivers is the corrupt one. If you right-click on it and go to properties there will be no version nr.

so...

1. boot up with BartPe and scan for viruses using mcafee (update defs before creating iso)
2. Delete the NDIS.sys file in C:\Windows\System32\Drivers
3. Copy the NDIS.sys file from D:\WINDOWS\ServicePackFiles\i386 to C:\Windows\System32\Drivers

Remove BartPE and Reboot.
Thanks! HP was going to send me a dvd drive and xp discs since I'm on a netbook for 60 dollars. Worked for me. Again thank you!
I saved a friend of mine's life thanks to this, thx! This is the only board where I could find a good solution.
1
Thank you
Thanks Guys,
i took one of our other pc copied the c:\windows\system32\drivers from the other pc and replaced it on the one where I was having the problems and its fixed

thank you
1
Thank you
TEST2004 IS A GENIOUS!!!

i kept getting the BSOD whenever I replaced ndis.sys with new one

so....

i made the NDIS.REG with the content TEST2004 supplied, Didnt work AGRHHH so I manually entered all the values and BOOM! SUCCESS

THANKS !!
0
Thank you
your the man. that was exactly what was needed.
TGFG. thank god for google.
0
Thank you
Well my system does't even let me copy the ndis.sys file. If that is teh case with other systems then how am I suppose to copy it from another system?

Thanks and regards :)
0
Thank you
replacing the file wrked gr8


thanks alot
0
Thank you
i had replaced the file from another computer, and also tried expanding them from my windows CD, but wasnt getting anywhere because every time I tried, the computer would crash while windows was loading drivers, causing a boot loop for me.. (i was fortunately able to load into a boot cd to then remove the file again and get windows back to a working condition but still had the driver error)

I fixed the problem by expanding the ndis file from the windows cd in windows.

open the start menu, and click RUN.

type "expand (cd drive letter):/i386/NDIS.SY_ c:/windows/system32/drivers/ndis.sys" without the ""s and press ok.

then when you restart the computer you will notice that windows doesnt load.

your windows disc should still be in the drive, so boot from that and perform a repair install:

at the first menu hit "enter", then at the disclaimer hit "F8", then in the next menu if it gives you the option hit "R" to start a repair install.

(please make sure you have your windows XP cd key)

this should repair any disturbance causing the boot loop, and set your computer straight

you will need to reinstall service pack 3, and all windows updates after.
cool it work on my office mate desktop..thank you everyone.. another experience for me again!
this really helps! it was a success on my acer travelmate and it did fixed my problem with the connectivity adapters!
0
Thank you
This Ndis.sys replacement worked for me!
Thanks.
1 2 Next