If you have yellow symbols in your network card (on your hardware list), you must add a new copy of NDIS.sys in your c:/windows/system32 (if you have scan it with your virusscanner, it maby not exist. Just add or replace it from our Windows CD or a working system.


If you have replaced it and you reboot and get a blue screen, Just reboot to Savemode en open regedit en add the registerkeys below!


PROBLEM:

The antivirus removes/quarantines the infected NDIS.sys and once you replace it with a known good copy the operating system fails with a blue screen during normal startup.

SOLUTION:

I compared the relevent registry entries on a working machine with a problem machine (previously infected with the Virut virus).

On the machine with the problem, the following registry key was not present:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS

Once this key was restored along with its data, the machine booted up fine again.

The data for the key is given below (.reg format). It was taken from an XP Pro SP2 machine and isn't necessarily correct for all other verisions of Windows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS]
"DisplayName"="NDIS System Driver"
"ErrorControl"=dword:00000001
"Group"="NDIS Wrapper"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\MediaTypes]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Parameters]
"ProcessorAffinityMask"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS\Enum]
"0"="Root\\LEGACY_NDIS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001