Code 39 error on network cards due to virus Solved/Closed

Question

Hello,

I wonder if someone could help me?  I recently had some virus trouble on my PC, and for some reason now I cannot access the internet as all my network adaptors all come up with an icon (yellow circle and black exclamation mark).  On checking this it says that this is a code 39 error and that the driver may be missing or corrupted.

I have tried uninstalling the adaptor software and reinstalling it, but it still comes up with the same message.  The same thing happened when I added a new adaptor to my PC.

Is there anything else that I can do do try and rectify this issue and get connection to the internet?

Hope someone can help,

Iain

Steve · Accepted Answer

I was working on an XP machine that was very badly infected. I cleaned up the infection, and the machine was fine except for that all networking devices were not working with Code 39. I ran sfc /purgecache, which was successful, all files checked out with sfc /scannow, but the cards still did not show up. It turned out that ndis.sys was totally missing from C:\WINDOWS\system32\drivers, and copying in the file from another XP installation fixed the problem. I suppose the Code 39 error was due to the missing NDIS wrapper in ndis.sys, not problems with the networking drivers themselves.

godoi · Answer

i'm with a same problem! =/
how dd you fix it?

Eli · Answer

i had this error but I think I fixed it 

first get all viruses off pc than start looking into ndis.sys 

http://www.hardwareanalysis.com/content/topic/41945/

if it is missing in your drivers folder find a version of xp & copy it from there as soon as I copied it to my drivers I got a virus quar that killed a liked named virus in the dllcache folder sytem32/dllcache/ndis.sys is a virus <------


hope this helps it did for me now im trying to fix the other problems I created fking with the registry 


Eli

585 · Answer

as Eli wrote...
use command line (press WIN+R, type CMD and then press ENTER). here write
"sfc /PURGECACHE" without quotes (this will remove DLLCHACHE folder C:\windows\system32\dllcache )

if error 0x00000005 appear (access denied), download program UNLOCKER (use google to find it) and install it, press right button on ndis.sys and select UNLOCKER. select DELETE and push OK button. then after some seconds appear question "Remove after restart?", push YES.

do same on file ndis.sys located in folder C:\windows\system32\drivers

restart.

after restart run "sfc /PURGECACHE" without quotes  again. if no error appear, you are almost done.
run "sfc /SCANNOW" without quotes to chceck originality of windows files. it maybe executed automaticaly on system start.
chceck both ndis.sys files like this: click on PROPERTIES and you must see a VERSION card. otherwise virus is still present, file is infected. DELETE again both files, repeat steps described above...

and sorry for my English, I am Slovak...

Mr. X · Answer

I had the same problem, all network card drivers were showing up with a yellow exclamation mark in device mananger after a reboot. I've tried running the sfc commands as described by Eli, but that didn't solve the problem. When I went to check ndis.sys file, it turned out that it wasn't there. The SFC /scannow command did not restore the file. Neither did re-applying the latest Windows service pack. 

For me, simply copying the file from C:\WINDOWS\ServicePackFiles to C:\WINDOWS\system32\drivers and rebooting the PC resolved the problem.

michael · Answer

your the man. that was exactly what was needed.
TGFG. thank god for google.

Steve · Answer

As I haven't registered, I don't seem to be able to edit my message, but I felt I should mention that I also had to boot up again after adding the file.

dmags · Answer

PROBLEM SOLVED:


Most viruses these days infect the c:\windows\system32\drivers
dis.sys file! the file is usually removed by your virus scanner.      JUST REPLACE THE NDIS.SYS FILE WITH A CLEAN ONE FROM ANOTHER MACHINE INTO THE C:\WINDOWS\SYSTEM32\DRIVERS FOLDER AND IT WILL WORK FINE AFTER A REBOOT.  ALL YELLOW EXCLAMATION MARKS JUST DISAPEAR. I HAVE HAD TO DO THIS MANY TIMES!!!

Ali · Answer

Well my system does't even let me copy the ndis.sys file. If that is teh case with other systems then how am I suppose to copy it from another system?

Thanks and regards :)

Rodrigo · Answer

HEY!!!!! Replacing the ndis.sys file worked PERFECTLY for me. Im using HP pavilion DV2000 Windows xp sp3.  Thank you guys!!!!!!!! You made me feel happy I was frustrated for many days ...... god bless you

Greetings from mexico

Stephen · Answer

Just wanted to give a final update on my end: I finally solved the problem of replacing the "ndis.sys" file and avoiding the blue-screen, failed startup. You see, every time I tried copying a new, clean ndis.sys file (from various places and other WinXP machines) into the 'drivers' folder, I would try to reboot but could only startup Windows in Safe Mode. So I would have to remove the same 'clean' ndis.sys file that I just copied into there  so I could load Windows normally. But that put me back at square one with all of my network connections on code 39 error, and additionally my graphics card was showing an error 10 - "device could not start." Ugh, absolutely frustrating.

I simply left out the "ndis.sys" file from Windows\system32\drivers\ and used Windows "System Restore" utility to restore my laptop to its original settings that were in place a few days before the virus wreaked havoc on my system. I rebooted and everything was like new! The system restore even restored the missing "ndis.sys" file on its own...SUCCESS! Anyway, I found this thread and everyone's input here very helpful in leading me to solve the issue. Thanks everyone!

MarkM · Answer

Here's a good overview of the Code 39 error and what to do about it:

https://www.lifewire.com/how-to-fix-code-39-errors-2623185

There's nothing specific on the blue screen you got but as far as the device manager error, this page has some good steps. I had a 39 error on my keyboard and this advice helped me take care of it.

Hentie · Answer

If you can't replace the NDIS.sys file in windows then use BartPE to boot your system. You can get it from here:
http://www.nu2.nu/pebuilder/

I've also had the same problem and it is important to note:

The NDIS file in C:\Windows\System32\Drivers is the corrupt one. If you right-click on it and go to properties there will be no version nr.

so... 

1. boot up with BartPe and scan for viruses using mcafee (update defs before creating iso)
2. Delete the NDIS.sys file in C:\Windows\System32\Drivers
3. Copy the NDIS.sys file from D:\WINDOWS\ServicePackFiles\i386 to C:\Windows\System32\Drivers

Remove BartPE and Reboot.

bengling · Answer

Thanks Guys,
i took one of our other pc copied the c:\windows\system32\drivers from the other pc and replaced it on the one where I was having the problems and its fixed 

thank you

blaine · Answer

replacing the file wrked gr8 


thanks alot

fitzy · Answer

i had replaced the file from another computer, and also tried expanding them from my windows CD, but wasnt getting anywhere because every time I tried, the computer would crash while windows was loading drivers, causing a boot loop for me.. (i was fortunately able to load into a boot cd to then remove the file again and get windows back to a working condition but still had the driver error)

I fixed the problem by expanding the ndis file from the windows cd in windows.

open the start menu, and click RUN.

type "expand (cd drive letter):/i386/NDIS.SY_ c:/windows/system32/drivers/ndis.sys" without the ""s and press ok.

then when you restart the computer you will notice that windows doesnt load.

your windows disc should still be in the drive, so boot from that and perform a repair install:

at the first menu hit "enter", then at the disclaimer hit "F8", then in the next menu if it gives you the option hit "R" to start a repair install.

(please make sure you have your windows XP cd key)

this should repair any disturbance causing the boot loop, and set your computer straight

you will need to reinstall service pack 3, and all windows updates after.

test2004 · Answer

If you still have an issue with booting into normal windows mode afer copying ndis.sys to  c:/windows/system32/drivers/ndis.sys, means you are missing registry entry for this file. So 1 more step required.
Have to copy it from good computer with same OS.
Or use mine (XP sp3 pasted below, no editing needed). Save this as a *.reg file with notepad and after opening it will add it to your registry, good luck, worked for me:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS]
"DisplayName"="NDIS System Driver"
"ErrorControl"=dword:00000001
"Group"="NDIS Wrapper"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\MediaTypes]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Parameters]
"ProcessorAffinityMask"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Enum]
"0"="Root\LEGACY_NDIS\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS\0000]
"Service"="NDIS"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000020
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="NDIS System Driver"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NDIS\0000\Control]
"ActiveService"="NDIS"

lsi-92 · Answer

Thanks test2004, here's the last bit of goodness needed to fix this...

To add subkeys to the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root key, you must first give yourself permissions to edit the key:

1. Open REGEDIT
2. go to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\
3. in the left pane, right-click the "root" key
4. click permissions
5. click the Add button
6. type "Administrator" into the box, then click OK
7. click Administrator (once)
8. in the Permissions for Administrator panel, in the Allow column, tick the box [ ] Full Control
9. click OK

Now, subkeys can be imported by Administrator to the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root key.  Double-click a valid .REG file to import.  REGEDIT should update the screen automatically.

Once the import is successful, remove the permissions you just added:

1. Open REGEDIT (if not already open)
2. go to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\
3. in the left pane, right-click the "root" key
4. click permissions
5. click Administrator (once)
6. click the Remove button
7. click OK

Note, I think that the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key is a mirror of one of the HKEY_LOCAL_MACHINE\SYSTEM\ControlSetXXX keys (where XXX is a number).  In my testing, I did not need to add to the "CurrentControlSet" key, it was auto-updated when I added the key to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001.

Note, the key should be added to ControlSet002, ControlSet003 etc if they exist.

Once all the keys have been added, and permissions reset back to normal, reboot.

Assuming you were trying to fix a blue-screen/reboot following replacing NDIS.SYS, and your system was otherwise OK, you should now find that you can login in normal mode.

Bob · Answer

This Ndis.sys replacement worked for me!
Thanks.

np1000 · Answer

I'd like to thank you guys. I almost had to reformat a client's machine but a XP repair did it. Whew!!! you saved me a tonload of  headache!!!

Thanks Again!!!

kitkat224 · Answer

TEST2004 IS A GENIOUS!!!

i kept getting the BSOD whenever I replaced ndis.sys with new one 

so....

i made the NDIS.REG with the content TEST2004 supplied, Didnt work AGRHHH so I manually entered all the values and BOOM! SUCCESS 

THANKS !!

Code 39 error on network cards due to virus

21 responses

Similar discussions

Subscribe To Our Newsletter!