I assume the one in the system32\drivers folder is bigger than 0KB in windows explorer ?
Try copying it to a different location changing the name to ndis.old and try uploading that one, I can’t understand why the original upload was 0KB (and empty file).
The only time I have seen that is when people try to upload a file from the chest and that can’t be done because it is a protected area.
Did you read the full information on the link the FWF gave and I repeated above to vil.nai.com above as this goes on to suggest replacing NDIS.SYS file with a known good version.
Though no samples have yet been seen to confirm, there are reports of this threat having a "watchdog" capability or parent component, typically via a patch to NDIS.SYS. If this is the case, Spam-Xarvester may be re-created by the patched file after cleaning. In this situation it may be necessary to first restart in Safe Mode and manually replace the patched NDIS.SYS file with a known clean copy of the appropriate version for your operating system and patch level.
This should only be done if the one in system32\drivers is found to be infected using YirusTotal or Jotti.
