Faulty Device Driver

By bignav88
May 30, 2008
  1. Hey!

    I'm about to address my first problem which I didn't manage to solve on my own. This forum has helped me over the years and the amazing thing is, that I wasn't even a member then. But anyways, here is my problem.

    Basically, it started to happen a month ago. My computer would randomly restart itself without any warning (mostly when playing games) It would restart normally and then would come with a windows message saying that, "The system has recovered from a serious error"...bla di bla know the score!

    At first, I didn't bother to do nothin as my computer never restarted when used normally, it only did it durin playin games. But last week, it restarted itself when i was just listenin to some music on winamp and chatting on msn. This annoyed me so I decided to send the error report to Microsft.

    The report suggested that it was caused by a faulty device driver. That was the only helpful thing about the report. Using that suggestion, I researched the internet and came across a program, "verifier" It helped me find the name of the driver. I did that because at first I thought it was my video or sound card causing the problem and i reinstalled the latest versions of those and updated my Direct X to version 9c.

    So anyway, the verifier displayed this message when it found the faulty driver, "Io System verification error in NDIS.sys [WDM Driver 226] NDIS.sys+7010 at BA66D010"

    I looked around the internet for a solution, because at the time this was happening, I was running my windows on SP2, one topic on Microsoft forum suggested that updating to SP3, may solve the problem, but unfortunately it didn't! However, i also found this website, which a guy was having the same problem. He managed to fix it by copying the file "NDIS.sys" from another computer running on SP2. He did so by renaming the original and replacing it with the new one from the other computer.

    So, the reason for my long boring post (sorry) is to ask for other ideas and whether if i should do the same. Basically, anything to solve this annoying problem! My system spec's are available to see so please help me.

    I'm terribly sorry for posting such a long post, i just wanted to give as much info as possible as I do not want to ruin my computer. Thank you for your time.

  2. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Can you tell us what error code(s) were displayed when it blue screened like 0x0000000050 as an example? NDIS.sys is a Windows core driver and it doesn't really tell us much
  3. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Also, the brand and model of computer... and the video graphics card or port.
  4. bignav88

    bignav88 TS Rookie Topic Starter

    Thanks for your response guys. Basically, when my computer restarts itself, it has never displayed a blue screen. It just reboots and logs onto XP normally and just displayin the message that it has recovered from a serious error.

    The blue screen comes up when i run Verifier. I ran it again today to see if i missed out any error codes but this was the exact message


    Beginning dump of physical memory
    Physical memory dump complete

    That was the exact message i get everytime i run verifier. You can find the details of my system in my user profile.

  5. bignav88

    bignav88 TS Rookie Topic Starter

    Talk about convenience, my computer now has displayed the blue error screen for the first time. This is the error code:

    ***STOP: 0000008E (0xC0000005, 0x00006C82, 0xF88F5968, 0x00000000)
  6. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70


    A kernel mode program generated an exception which the error handler didn’t catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade).

    The question is which hardware or which driver.
  7. nobardin

    nobardin TS Rookie Posts: 256

    If you navigate to C:\WIndows\Minidump there should be dump file(s) in there.

    Upload the most recent one then go backwards and attach 2-3 additional ones.
  8. bignav88

    bignav88 TS Rookie Topic Starter

    I see, i ran the verifier and it says that it was a WDM Driver Error 226 in NDIS.sys. Do you think i should replace the NDIS file from another computer running on XP SP3?
  9. bignav88

    bignav88 TS Rookie Topic Starter

    Here are the latest minidump files. Hope it helps
  10. bignav88

    bignav88 TS Rookie Topic Starter

    Right, this is really weird. My computer crashed onto a blue screen for the 2nd time today. But this time, it was a different error code. Here it is:


    ***STOP: 0x000000D1 (0x80800000, 0x00000002, 0x00000000, 0x80800000)
  11. bignav88

    bignav88 TS Rookie Topic Starter

    This is gettin annoying now. Another crash to the blue screen but with a different error code again!


    ***STOP: 0x0000000A (0x38A08300, 0x000000FF, 0x00000000, 0x804F4885)
  12. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Have you tried reinstalling the driver, after removing or disabling old ones?
  13. bignav88

    bignav88 TS Rookie Topic Starter

    ive re-installed my graphics, sound and ADSL diver but thats it. Like i said, verfier says that the error is in NDIS.sys? If anyone could send me there NDIS.sys from a XP Home edition SP3 OS then it may sort it out
  14. raybay

    raybay TS Evangelist Posts: 7,241   +9

    NDIS.sys stands for "Network Driver Interface Specification", and the problem is usually within the network driver specification.
    NDIS.sys can be found at C:\Windows\System32\drivers. Various online sites report the files on WXP and WXPP as 182912 bytes (88% of all occurrences), 167552 bytes, 500840 bytes, 182528 bytes, 266500 bytes.

    This driver may be started up, or stopped, using "Services" in <Control Panel> and with other programs you can find with a Gurgle search. NDIS.sys is a Windows core system file that is not viewable. If legal, it has a Microsoft signature. The NDIS.sys has no description, except that it may be a compressed file. It is not considered particuarly dangerous, and several paid software programs will repair it.

    Various infestations can disguise themselves as NDIS.sys. They locate themelsves in c:\windows or c:\windows\system32 folder. You must take a look at the NDIS.sys process within your computer to decide if it is malware. You can easily search online at Google and elsewhere for software removal tools that will work

    This problem has been around for a very long time. One way to fix it is to use the Recovery Console (see explanations at to fix it on your computer using a Windows Disc.

    Other ways: Use paid repair software. Use a Windows Disk in repair or recovery console mode, Remove the driver and other network settings and reinstall.
    Some people get away with just removing NDIS.sys altogether. If windows needs it, it will get it back.
    Also, buy the Windows Service Pack 2 on disk from microsoft and run that. It will update your system in a way that works.
  15. raybay

    raybay TS Evangelist Posts: 7,241   +9

    From Microsoft:

    STOP 0x0000001D or STOP 0x000000A Stop Error Occurs in Ndis.sys
    View products that this article applies to.
    Article ID : 818326
    When you change the IPX frame type for your network connection from Auto Detect to any other IPX frame type, you may receive a "STOP 0x0000001D" or "STOP 0x000000A" Stop error that occurs in Ndis.sys.

    This problem may occur if you installed the NWLink IPX/SPX/NetBIOS Compatible Transport protocol on your computer and you are using the Driver Verifier Manager to troubleshoot your Ndis.sys driver's Special Pool feature.

    Service pack information
    To resolve this problem, obtain the latest service pack for Microsoft Windows XP. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
    322389 ( How to obtain the latest Windows XP service pack

    A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

    If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

    Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: (

    Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language. The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

    Date Time Version Size File name
    29-Apr-2003 19:14 5.1.2600.1215 162,816 Ndis.sys
    29-Apr-2003 19:13 5.1.2600.1215 84,864 Nwlnkipx.sys

    Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Microsoft Windows XP Service Pack 2.

    visit the following Microsoft Web site:
  16. nobardin

    nobardin TS Rookie Posts: 256

    The process cited in your minidumps is Dslmon.exe. This is a Sagem DSL Modem Component go there and download and install Ccleaner and scan your pc and registry and fix any problems it finds

    Here is the contents of your minidumps..1 and 2 say the same thing. Haven't looked at 3 yet.
    BugCheck C9, {226, ba66d010, 0, 0}

    Probably caused by : NDIS.sys ( NDIS!ndisDeviceControlIrpHandler+0 )

    Followup: MachineOwner

    The IO manager has caught a misbehaving driver.
    Arg1: 00000226, (Fatal error) An IRP dispatch handler has returned without passing down or completing this IRP, or someone forgot to return STATUS_PENDING. (IRP specified.)
    Arg2: ba66d010
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:

    ERROR_CODE: (NTSTATUS) 0xc9 - The operating system cannot run %1.

    BUGCHECK_STR: 0xc9_226


    ba66d010 8bff mov edi,edi

    ba66d010 8bff mov edi,edi



    PROCESS_NAME: dslmon.exe

    LAST_CONTROL_TRANSFER: from 80675fea to 8053380e

    STACK_COMMAND: .bugcheck ; kb

    SYMBOL_NAME: NDIS!ndisDeviceControlIrpHandler+0

    FOLLOWUP_NAME: MachineOwner




    FAILURE_BUCKET_ID: 0xc9_226_NDIS!ndisDeviceControlIrpHandler+0

    BUCKET_ID: 0xc9_226_NDIS!ndisDeviceControlIrpHandler+0

    Followup: MachineOwner

    Maybe contact your ISP and find out if they know anything about it or have a fix for it, because it is saying there was a driver fault with Dslmon.exe which is a monitoring tool for your Sagem USB DSL Modem.

    Or maybe an uninstall/reinstall of the utility.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...