Jump to content
MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. ×

The compiled FAQ & guide thread


Recommended Posts


1a. XP FAQ

1b. Service pack slipstreaming and bootable CD guide.

2. XP SP3 FAQ.

3. Windows XP driver locator Guide, Need drivers for XP? Heres what we need from you.

4. Memory dump options for Windows XP

5. Using Process Monitor

6. Download Links to Windows XP Official SPs and IE upgrades







Windows XP Forum Posting Rules

1) The most important rule
Search to see if your topic already exists. Commonly answered questions will be closed.

2) If you are getting an error, check the Windows 2000/XP Troubleshooting Guide
If you follow this guide, you may solve your own problem without needing to ask anything. If following the guide doesn't solve your problem, write what you have tried to do to solve the problem.

Zxian’s Windows 2000/XP Troubleshooting Guide

3) Malware problems?
Got a virus, spyware, or adware? MSFN has a forum just for you. Check here for more information:

Malware Prevention

4) Regarding nLite
If you have used nLite to remove components from your Windows installation, check in the nLite forums for answers to your problems. Errors caused by nLite are beyond the scope of this forum.

nLite Forums

6) Provide enough information
Simply saying "I'm getting an error. Plz help!!!" isn't going to do anyone any good. We don't know what your problem or question is, and as a result, you don't get the help that you could. If you are getting a Windows error message, program error message, or any other type of error message, you MUST provide the complete error message along with any error codes that may appear.

7) Please post legibly.
Please try to use proper sentences, and if there are several points in your topic, break it up into paragraphs. It makes it much easier to read and understand, and as a result you'll probably get a better answer sooner.

8) Follow the MSFN Rules.
So there's no confusion as to where to find them, here's the link:


 ***** MSFN Forum Rules *****

Following these rules makes it easier for everyone on the forums. You get your answer quicker, and others who are helping you have an easier time understanding you.

Thanks to Zxian  and Bâshrat the Sneaky  for the rules outline.
Link to comment
Share on other sites

1a. XP FAQ

Originally posted by Zxian

Dude, Where's my RAM?

We are often asked why Windows Vista / Windows Server 2003 / Windows XP etc. only sees a portion of the installed memory. It is pretty common for a machine with 4GB of RAM to actually show between 3.1 and 3.6GB of RAM installed, although this number may actually be less depending on hardware.

-Full article

svchost.exe uses 100% of CPU and almost 100 MB of RAM!!!

If you're getting severe slowdowns by a svchost.exe that eventually goes away, but is just really annoying, don't worry - it's probably not a virus! It could be caused by Microsoft Update checking updates for programs that use the Windows Installer. Check the KB article for a download link to a possible fix.

-MS KB927891.

1b. Service pack slipstreaming and bootable CD guide

Originally posted by xper

This guide will describe the easiest way possible to slipstream (also known as 'Integrate') a Service Pack into Windows 2000, XP or 2003. The days of typing out command switches, and fiddling with boot sectors and ISO settings in Nero are long gone, so none of that will be described here! :-)

To do this, we will only need one program - MSFN's very own popular nLite created by one of our members nuhi. While nLite is primarily aimed to remove components to slim down a Windows CD, it has the required tools to do just an automated Service Pack slipstream as well as create a CD image.

Universal Unattended Windows Guide

nLite Forum

Link to comment
Share on other sites


Originally posted by geek

Q: Where can i download it and which version should i download?

A: Depends on how many machines you will be updating.

1-3 machines: Windows Update / Microsoft Update

More than 3: Network Installation Package (or if creating a slipstreamed copy)

Manually updating multiple machines with slow/no internet connection: ISO-9660 CD Image File - NOTE: this is the service pack inside an ISO file only. You will still need an XP source CD to create a SP3 slipstream disk.

MUI Pack Update - Language pack for SP3

Q: What Service pack level do I need to install SP3?

A. XP SP1a or greater.

Q: What Service pack level do I need to slipstream SP3?

A. XP SP1a or greater for the OS you will be executing the slipstream process under. The Source/Destination OS can be any SP level (though most recommend that SP3 only be slipstreamed into SP0/GOLD/RTM Source.

Q: Where is the x64 version?

A: Windows Xp x64 edition is based off the Server 2003 x64 kernel. This is not the service pack you are looking for. For the latest x64 SP3 info try the x64 forum

Q: Where is the XP MCE version?

A: At the time of this post, Windows XP MCE edition has yet to be released. This is not the service pack you are looking for. For the latest MCE SP3 info try the MCE forum

Q: Is IE7 included in SP3?

A: No IE7 is NOT included as part of SP3. however, you should be aware that if you have IE7 Installed at the time SP3 is applied,you will not be able to revert to IE6 without uninstalling SP3 first.

Q: Is Windows Media Player 10/11 included in SP3?

A: No WMP11 is NOT included as part of SP3. If you slipstream SP3 into a XP GOLD/SP0/RTM Source, you will have WMP9. you can get WMP11 through WU/MU but WMP10 will not be offered as an option. If you want WMP10, you can get it here.

Q: 3rd Party themes dont work after installing SP3:

A1: You need to repatch your UXtheme.dll see this thread: SP3 UX theme patcher

A2: Alternative posted by Yzöwl: XP SP3 patched UXTHEME.DLL (zipped, direct download contains .DLL and .DL_ versions)

Q: I had the Windows Firewall service set to disabled before SP3 and now I cant VNC to a machine after installing SP3.

A: SP3 sets the Windows firewall Service to Automatic during install. before you restart after installing SP3, be sure to re disable it.

Q: Since installing SP3 I cant move the IE address bar to the taskbar.

A: Yes that feature has been removed. This Issue is being discussed here.

Q: My CD key no longer works after Slipstreaming SP3:

A: Don't Slipstream XP SP3 from a PC running Vista or Server 2008. Windows XP GOLD/SP0/RTM, SP1, SP3 and Server 2003 are all confirmed to work properly

Q: Were can i get more information about whats in SP3?

A: Windows XP Service Pack 3 Overview

Link to comment
Share on other sites

3. Windows XP driver locator Guide, Need drivers for XP? Heres what we need from you.

Originally posted by PC_LOAD_LETTER

The original topic can be found here for replies and more additional information.

I have noticed an increasing number of people requesting drivers for Windows XP because they want to migrate away from Windows Vista for whatever reason. (wont get into that here)

Only a few people have been able to provide all the information needed to help them locate the drivers they need for their XP Build. Sometimes we can hunt down a driver with only the make/model of the machine but in truth more information is required to find the best drivers. Therefore I have decided to make a post with instructions on how to get information about your system to the MSFN community so they can help you find drivers. In the process of getting them the information, you may get enough information to locate the drivers on your own.

Download and extract Unknown Devices on the machine you are looking for drivers for.

If you have Internet access on the machine you are looking for drivers for:

Run UnknownDevices.exe then click List->Show->All


Then click List->Upload list to pastebin


Enter a comment if you like and hit upload


a page like this one will open -just close that and paste the link into your post here at MSFN (it will be copied automatically)

If you do not have Internet access on the machine you are looking for drivers for:

Run UnknownDevices.exe then click List->Show->All


Then click List->Save list to file


Save the list



Open the text file and remove your product key or change it to something totally different as i have done here:

Computer Info
Chipset: <unknown>
Computer Name: FOURBYFOUR
OS: Windows Vista (TM) Business (OEM)
Product Key...
Device Tree
Bluetooth Devices
Bluetooth Bus Enumerator
Kensington Bluetooth Device
Kensington Bluetooth Device

Now either upload the text file in your post or paste its contents into a new topic

Please do not reply to this thread with your results. Only reply to this post with Problems/Questions/Comments on this information gathering process. To get the best possible assistance with locating your needed drivers, Please create a new post in whatever your target OS will be (ie XP 32Bit Edition XP 64Bit Edition, or XP Media Center, etc)

Link to comment
Share on other sites

  • 2 weeks later...

4. Memory dump options for Windows XP


For applications that hang or crash, the Debugging Tools for Windows are the easiest way to obtain a memory dump to analyze:

Debugging Tools for Windows - Overview


1. Open a command prompt and change the working directory to where you installed the Debugging Tools for Windows

Commands to switch to the default folders depending on the version of Windows installed:

32-bit: cd "\Program Files\Debugging Tools for Windows (x86)"

64-bit: cd "\Program Files\Debugging Tools for Windows (x64)"

Determine first if the application is crashing ("this program has encountered a problem and will be shut down") or hanging ("not responding"):

For CRASHING applications:

2. Enter the following command to attach to the running process MYAPP.EXE (replace as appropriate) which will crash:

adplus -crash -ctcf -pn MYAPP.EXE -quiet -o C:\AppDumps

> Whilst waiting for the process to crash you will see a minimized cdb.exe process

3. Wait for the application MYAPP.EXE to crash (or reproduce the crash if possible)

> A unique folder will be created in C:\AppDumps with the dump file and some .TXT files containing process & thread information

> The minimized cdb.exe window will close when it is done

For HANGING applications:

2. Enter the following command to attach to the hung process MYAPP.EXE (replace as appropriate):

adplus -hang -ctcf -pn MYAPP.EXE -quiet -o C:\AppDumps

> A unique folder will be created in C:\AppDumps with the dump file and some .TXT files containing process & thread information

> The minimized cdb.exe window will close when it is done

> The MYAPP.EXE process is not terminated


On Windows versions later than Server 2003, the method for getting a dump of a hung process is much easier and does not require the Debugging Tools to be installed - simply start Task Manager, switch to the Processes tab, right-click the process that is hung and select Create Dump File from the context menu. Once the dump process is completed you are informed as to where the file was created.


By default, Windows XP only creates "minidumps" a bugcheck (bluescreen) occurs - this is 64KB and contains almost no information to help with a good analysis.

The OS needs to be prepared to produce the right level of detail when bugchecks occur - "kernel" or "complete" dumps.

Kernel dumps will be smaller, but do not hold any information from user-mode space.

Complete dumps contain kernel and user-mode memory and can be considerably larger.

Most of the time kernel dumps are enough to perform good analysis of a problem, and as they are smaller they are quicker to produce and to upload/download.

A memory dump from the OS is created in PAGEFILE.SYS on the boot volume (typically C:) during the time the STOP screen is displayed, along with "beginning dump of physical memory".

Windows then restarts and the dump is copied from C:\PAGEFILE.SYS into a separate file, defaulting to C:\WINDOWS\MEMORY.DMP.

Because the page file on the boot volume is required, it must exist and have its initial size large enough to guarantee a successful dump:

KERNEL (32-bit): physical RAM plus 50MB up to a maximum of 2098MB

KERNEL (64-bit): physical RAM plus 50MB

COMPLETE (32-bit and 64-bit Windows): physical RAM plus 50MB

Additionally you need at least the same amount of free disk space on the boot volume to guarantee that MEMORY.DMP is created.

e.g. If there is 4GB (4096MB) of RAM installed:

32-bit kernel dump requires: C:\PAGEFILE.SYS 2098MB + at least 2098MB of free disk space on C:

64-bit kernel dump requires: C:\PAGEFILE.SYS 5046MB + at least 5046MB of free disk space on C:

complete dump requires: C:\PAGEFILE.SYS 5046MB + at least 5046MB of free disk space on C:

To check the page file settings:

- Click the Settings button under Performance

- Click the Advanced tab

- Click the Change button

- Check the page file on the boot volume is large enough, as per the paragraph above

To prepare the system to create a useful memory dump the next time it bugchecks:

- Right-click My Computer, click Properties

- Click the Advanced tab

- Click the Settings button under Startup and Recovery

- Under Write debugging information, select Kernel memory dump or Complete memory dump as required


If the Complete memory dump option is needed and not available (can occur when there is >=2GB RAM present), you need to modify the following registry value manually via RegEdit:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

Name: CrashDumpEnabled


Data: 1

For situations where Windows is hanging (rather than crashing), if you have a PS/2 keyboard connected then you can configure the system to bugcheck on demand by creating the following registry value via RegEdit (then reboot afterwards):

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters

Name: CrashOnCtrlScroll


Data: 1

To bugcheck the system, hold down the right-hand CTRL key and press SCROLL LOCK twice.


On Windows versions later than Server 2003, the dump options are configured in the same place, but to get there you right-click Computer on the Start menu rather than My Computer on the desktop, and click Advanced System Settings in the left pane.


Due to file / folder permission restrictions, before compressing or attempting to open dump files it is best to make copies of the files to work with - on the desktop or a TEMP folder is advisable - otherwise "access denied" errors can be generated.


SkyDrive is a free Live service providing 5GB of online storage.

It is also recommended to compress the dumps first, using something like 7-zip.

Link to comment
Share on other sites

5. Using Process Monitor

Process Monitor (ProcMon) is a great tool for recording I/O-related activity on Windows - effectively a combination of the old RegMon and FileMon tools plus extra information such as process and thread creation and exit.

It will not show you inter-process activity, and in the case where files exist but contain garbage there will be no error to track, so it's not guaranteed to uncover all types of causes for program failures.

It is of particular use for situations where applications fail to launch if it is due to an "access denied" or "name not found" error when a process accesses specific registry or file resources.

It can also be useful for logging boot or logon activity (under Options / Enable boot logging) - on launching ProcMon after rebooting and logging on you can save the log produced for analysis.

It is recommended to use it for recording data with the default filter, and afterwards use display filters to focus on the I/O you are interested in.

Due to its nature, the system will run significantly slower while ProcMon is recording activity - keep the recording sessions as short as possible and have all unnecessary applications (and notification area processes) stopped.

You may want to consider stopping anti-virus during the recording session too, as it will generate more I/O and slow the system down further.

Bear in mind that "name not found" and "path not found" results may be normal - applications may check for the existence of certain resources in order to determine what they should do - a comparison with a ProcMon trace from an identical working system may be more productive in these situations.

"Buffer overflow" is also normal when reading from the registry - this is a probe to find out how large the item is before allocating memory and then requesting the data again.

ProcMon also records the stack of the thread for each log entry, and optionally use debugging symbols (with the help of dbghelp.dll from the Debugging Tools for Windows) to record more detailed function information.

It does not use the _NT_SYMBOL_PATH variable, the symbols path must be configured separately as well as specifying the location of dbghelp.dll via Options / Configure symbols.

The path for dbghelp.dll by default would be one of the following, depending on the verison of Windows:

C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll

C:\Program Files\Debugging Tools for Windows (x64)\dbghelp.dll

The symbols path can be configured in a similar way to _NT_SYMBOL_PATH, e.g.


After configuring the symbols options, ProcMon needs to be restarted - then you can verify they are resolving correctly by double-clicking a log entry to view the details and click the Stack tab - in the bottom left corner it should read "Loading symbol module for xxx..." for each module in the stack, from top to bottom (this can take a while).

As each symbol module loads, the stack display updates the "Location" field automatically to provide more detailed information for Microsoft modules for which there are public symbols available for the version in use.

Link to comment
Share on other sites

  • 7 years later...

Hopefully perpetual links to win XP SPs and IE upgrades:

I encourage you all to use and take advantage of the Internet Archive (WayBack Machine) to download Microsoft software.

The IA is a 501©(3) non profit organization in the United States, and has been archiving the web since 1996. It became officially recognized as a library by the State of California in 2007.

This ensures that we are using links that will NOT "mysteriously disappear" in the future. Also, questionable sources could lead to disastrous results.

Windows XP Service Pack 1 (SP1): https://web.archive.org/web/20020911143832/http://premierdownload.microsoft.com/download/whistler/SP/SP1/WXP/en-us/xpsp1_en_x86.exe

Windows XP Service Pack 2 (SP2): https://web.archive.org/web/20050618161252/http://download.microsoft.com/download/1/6/5/165b076b-aaa9-443d-84f0-73cf11fdcdf8/WindowsXP-KB835935-SP2-ENU.exe

Archived: Windows XP Service Pack 3 Network Installation Package for IT Professionals and Developers

Direct Download: https://web.archive.org/web/20140119014510/http://download.microsoft.com/download/d/3/0/d30e32d8-418a-469d-b600-f32ce3edf42d/WindowsXP-KB936929-SP3-x86-ENU.exe

Internet Explorer 7 if you need it: Internet Explorer 7 for Windows XP 32-bit

Direct Download: https://web.archive.org/web/20130509183828/http://download.microsoft.com/download/3/8/8/38889dc1-848c-4bf2-8335-86c573ad86d9/IE7-WindowsXP-x86-enu.exe

Internet Explorer 8 if you need it: Internet Explorer 8 for Windows XP 32-bit

Direct Download: https://web.archive.org/web/20130510043925/http://download.microsoft.com/download/C/C/0/CC0BD555-33DD-411E-936B-73AC6F95AE11/IE8-WindowsXP-x86-ENU.exe

Link to comment
Share on other sites

This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Create New...