The procedure entry point SHCreateThreadRef could not be located…

Date:October 14, 2004 / year-entry #366
Orig Link:
Comments:    86
Summary:Some people smarter than me have been working on this problem, and here's what they figured out. First, I'll just reprint their analysis (so that people with the problem and are searching for the solution can find it), and then we can discuss it. Update (18 October 2005): The official version of this document is...

Some people smarter than me have been working on this problem, and here's what they figured out. First, I'll just reprint their analysis (so that people with the problem and are searching for the solution can find it), and then we can discuss it.

Update (18 October 2005): The official version of this document is now available. Please use that version instead of following the steps below, which were based on a preliminary version of the instructions.

If you receive an error message: "Explorer.EXE - Entry Point Not Found - The procedure entry point SHCreateThreadRef could not be located in the dynamic link library SHLWAPI.dll", this information will help resolve the issue.

This appears to have been caused by the following sequence of events:

  1. You installed Windows XP Service Pack 2

  2. The installation of Service Pack 2 failed due to a computer crash during the installation which resulted in the automatic Service Pack Recovery process. On next boot, you should have received an error message telling you that the install failed, and that you need to go to the control panel and uninstall SP2 and then try re-installing it. This message may have been dismissed accidentally or by another individual using your computer. In any event, the Service Pack recovery process was not completed by uninstalling the service pack from the Add/Remove Programs control panel, and the system is consequently in a partially installed state which is not stable.

  3. You then installed the latest security update for Windows XP, MS04-038, KB834707. Because your system is still partially SP2, the SP2 version of this fix was downloaded and installed by Windows Update or Automatic Updates. However, the operating system files on the system are the original versions due to the SP Recovery process. This results in mismatched files causing this error.

To recover the system, carefully perform the following steps:

  1. Boot normally and attempt to log in to your desktop. At this point you should get the error message listed above.

  2. Press Control+Alt+Delete at the same time to start the Task Manager. (If you are using classic logon, click the "Task Manager" button.) You may get additional error messages but Task Manager will eventually start.

  3. On the menu bar, select File and then New Task (Run).

  4. Type in control appwiz.cpl into the new task box and hit OK. You may get additional errors that can be ignored.

  5. The Add/Remove Control Panel should now be running. You can close Task Manager.

  6. Near the bottom of the list, find the entry titled "Windows XP Hotfix – KB834707".

  7. Click on it and click the "Remove" button. It will take some time to complete. Once the "Finish" button is visible, click on it and reboot your system. If you get messages about additional software or hotfixes installed, you can safely ignore them.

Do NOT stop now! Your system is still in the "failed SP2 install" state. You MUST complete the SP2 uninstall, and then re-install SP2.

  1. Start the system and log in.

  2. Click on Start and then Control Panel.

  3. Click on the Add/Remove programs item.

  4. Near the bottom of the list, find the entry titled "Windows XP Service Pack 2".

  5. Click on it and remove Service Pack 2. You may get a warning about software you have installed after SP2. Make a note of it as you may need to reinstall some of them after the uninstall operation.

  6. After Service Pack 2 has been successfully removed, you should visit for instructions on installing Service Pack 2. You can get SP2 from

  7. After Service Pack 2 has been successfully re-installed, you should re-visit Windows Update to get the proper version of the latest critical security updates.


Q: I don't believe I am in the "partially installed SP2" state. Is there any way to check that?

A: After step 7, your system should be able to log in. There are several ways to check.

  1. Open the file c:\windows\svcpack.log, and scroll to the very bottom of the file. About 10 lines from the end, you should see: Executing script \SystemRoot\sprecovr.txt In cleanup mode. System will not be rebooted.

    If you have these lines in svcpack.log, and you did not uninstall Service Pack 2 in Add/Remove Programs, you definitely have a machine in this partially installed state.

  2. Click on the Start button, then Run, and type winver, then click OK. If the version is "Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158: Service Pack 2" then you have the correct SP2 install. If, however, it has a number that is less than 040803 after the xpsp2, such as "Build 2600.xpsp2.030422-1633 : Service Pack 2" then you definitely have a machine in the partially installed state. [Corrected typo in version numbering, 11am.]

Notice that the default answer to every dialog box is "Cancel". The Service Pack setup program detected a problem and gave instructions on how to fix it, and yet people just ignored the message.

The result of not fixing the problem is that you are left with a machine that is neither Service Pack 1 nor Service Pack 2 but instead is a Frankenstein monster of some files from Service Pack 1 and some files from Service Pack 2. This is hardly a good situation. Half the files are mismatched with the other half.

There was enough of Service Pack 2 on your machine that Windows Update downloaded the Service Pack 2 version of the security patch and tried to install it. This made a bad situation worse.

What's the moral of the story?

First, that users ignore all error messages. Even error messages that tell how to fix the error! Second, that ignoring some error messages often leads to worse error messages. And third, that once you get into this situation, you're off in uncharted territory. And there are only dragons there.

(These are the types of problems that are nearly impossible to debug: It will never happen in the test lab, because the test lab people know that when an error message tells you, "The install failed; you need to do XYZ to fix it," you should do it! All you can work from are descriptions from people who are having the problem, and a lot of creativity to try to guess "What happened that they aren't telling me?")

Comments (86)
  1. David Candy says:

    Me mum (that’s australian grammar) sold her old computer to her school friend. I went to install it. Every time we dialed the ISP we got a message but my mum would dimiss the dialog box before anyone could read it. Her friend was a WP instructor and we were both screaming at her to let us read the dialog (as we dialed up repeatedly to see the message). But even knowing we wanted to read it she couldn’t help herself and kept closing the dialog. We had to take the mouse off her. Then dial up then without a mouse she couldn’t close it and we could read

    "Telstra has problems – try again in an hour", which we did and it worked.

  2. Mike Dunn says:

    Something I thought of after reading the old post you linked to… I always wondered why the "configure security" screen you get after installing SP2 and rebooting was so huge and took up the whole screen, instead of just being a wizard that came up after logging in. Now I realize it’s meant to indicate to users that THIS IS REALLY BLOODY IMPORTANT, READ IT!

  3. James Summerlin says:

    A user dismissing a dialogue box without reading it.

    Imagine that.


  4. Matt says:

    I see an award here for the most politically correct statement of the year:

    "This message may have been dismissed accidentally or by another individual using your computer"

    Because we all know that I would never dismiss a dialog box intentionally without reading it…

  5. Jack Mathews says:

    The real moral of the story?

    Microsoft should do everything they can to recover from situations where a person powers off their machine during an install. Frankly, if this happens, the service pack should be uninstalling itself, not relying on the end user to do it.

    It’s like the old DriveSpace conversion program. If you killed that while it was working, then after the next boot, it would continue on from where you left off. This was the first and probably last really bulletproof install of Microsoft’s.

    If this thing, on the next boot, uninstalled itself and THEN put up a box saying "hey, the service pack was not installed due to an error, please install again" then you wouldn’t have these problems. You would have two cases, SP1 or SP2. No frankenstein.

    And if your test department is stupid enough to think that the users will follow every instruction given to them, then you need a new testing coordinator.

    The customer is always right. Period. Partial installs have been the bane of you guys forever, and it’s a solvable problem. Users ignore dialog boxes all of the time, and that’s a well known fact. It’s engineering’s fault for not finding a solution around it and test’s fault for not testing an actual user experience.

  6. Raymond Chen says:

    You can’t force the uninstall at boot; you have to wait for a user to log on. And the Setup program can’t just force a logon since it doesn’t know your password!

    The Service Pack Setup team knew that this was a possible problem but didn’t have time to develop the infrastructure to implement this "ultimate unattended failsafe" given the time constraints for Service Pack 2. Would you rather that SP2 have been yet another half-year late? (The testers did verify that the "Oh dear things are a mess right now; please do the following steps to fix it" dialog appears when it ought to.)

  7. GeraldH says:

    The text states: "If, however, it has a number that is less than 040804 after the xpsp2, such as "Build 2600.xpsp2.030422-1633 : Service Pack 2" then you definitely have a machine in the partially installed state."

    However, previously the string for the system with an intact SP2 is given as "Build 2600.xpsp_sp2_rtm.040803-2158". So is 040803 (which is less than 040804 according to my math book) okay or not? Is this just a typo or is my brain hemorrhaging?

  8. Raymond Chen says:

    Gerald, you are correct. The document even says that 040803 is a valid SP2 version number. This was just a typo in the original message; I’ve edited the article to correct this – hopefully avoid freaking people out thinking they have a corrupted SP2 install.

  9. Henk Devos says:

    Re: First, that users ignore all error messages. Even error messages that tell how to fix the error!

    I really can’t understand that you know there is a problem, you know it needs to be fixed, you know it’s important to fix it, you know how to fix it, and yet, instead of fixing it, you tell the user how to fix it and offer the "cancel" option.

    The excuses you are giving are really non-excuses. How hard could it be to add an entry to "run" as first step of the setup, do the same sanitty check there that’s already being done, and fire the uninstaller? I’m sure you can program this yourself in 1 day, hardly the half year that you are talking about.

  10. "You can’t force the uninstall at boot; you have to wait for a user to log on. And the Setup program can’t just force a logon since it doesn’t know your password!"

    I dont understand why this could not be done. The Serivce Pack roll back could be done via a service with administrative access. I mean Windows expects the users to be r00t all the time anyway so why not have the service pack install a new service that checks the state of the install and rolls it back if there was a problem. I mean all the service would have to do is run a VerQuery value on the dlls and if they did not all match the manifest for SP2 then roll it back to SP1.

  11. John [MSFT] says:

    You guys are right – we could have done better with the SPRecover process – given appropriate time. During SP2 beta testing, we started seeing enough installs that failed due to system crashes, power outages and other unexplained reasons that we decided to do something about it, and invented the new SPRecover process, but had very limited time to get it done and tested.

    In general, we think we’ve prevented/solved many cases where the machine would have been left completely unbootable. I had a friend who’s college daughters machine was crashing randomly – turned out to be too much dust inside the machine. SP2 install crashed numerous times on her machine and SPRecover saved the day! This was a case that was not due to software installed or the SP install.

    We did originally spec a full end-to-end automated uninstall but there are some major limitations. The SPRecover process is running in a special pre-boot mode, and all it can do is to copy back the saved recovery files – most of the OS services (APIs, etc.) are not yet loaded. You can’t do anything with the registry at this point, which precludes creating a Run or Runonce entry, or creating and registering a “system service”, among other things. You also don’t even know who are the machine user accounts – you could grovel the Documents directory but what if the machine has dozens or hundreds of users? So you can’t go dropping random files in the Start Up program files directory. Plus, whatever you do then has to be “undone” by the full SP Uninstall. Once the user logs in and runs the full SP2 Uninstall, it copies back the backed up registry, recopies all the saved recovery files, and un-does other things that may have been done by the SP2 installer and/or related processes. An SP Uninstall is a very complex process in it’s own right.

    Most users do follow the instructions. As Raymond mentions above, for the very, very few cases that hit SPRecover, and the even fewer cases that ignore the message, it may not have been worth a significant delay for SP2. Now that we are aware of this case, we can probably do some things with Windows Update in the future to detect and not offer updates to machines in this state, and to warn the users who are still in this state. And for future Service Packs, we’ll make SPRecover better.

  12. Zach says:

    Hah, here’s an interesting one:

    I have every SP2 file installed.

    I have no symptoms of a ‘hybrid’ service pack, nor any errors. I do not have the message in svpack.log

    My version number is what you say.

    HOWEVER, it still says Service Pack 1, and still wants me to install Service Pack 2. Even though it clearly successfully installed. The installer itself never said that, though, because it couldn’t unregister spuninst.exe

    bravo. >_<

  13. Jonathan says:

    Re the old DriveSpace – actually the current FAT->NTFS conversion is safe as well. My XP was running of FAT32 (for historical reasons). The power in my area like to go out for a second every now and then, so I decided to convert my system part. to NTFS. Of course, halfways through the convert, the power went out… When it came back, the process continued, and finished without error.

  14. Jon Potter says:

    Is there a forum or newsgroup (or even email address) for SP2 problems? I have one machine that the SP2 install performs flawlessly on, but on reboot Explorer fails to load, and it just sits there forever with a blank screen. The event log shows some sort of COM error (can’t remember exactly what). Uninstall works fine and then the machine is back to normal (but only with SP1 of course). Tried googling but haven’t found anything yet…

  15. Mike Dunn says:

    VC 7 shows some of the worst message boxes I’ve ever seen, usually in regards to source control problems. I run in 1280×1024 and I’ve gotten messages that are literally 6 lines of text, each line spanning 1000 pixels or so, with a bunch of buttons at the bottom. Ugh.

    What’s worse is that they are worded so badly, that when I *do* read the text, I still have no idea how to fix the problem.

  16. John [MSFT] says:

    top right corner – get help – will direct you to the correct support resources depending on where you live.

  17. Dan says:

    I don’t know if this is the error I’m seeing or not. I installed this update and the one for Office XP last night. While rebooting after the install I get a BSOD and the friggin OS is trying to be so helpful that it doesn’t even allow me to see what the error was, it just reboots. BSOD into safe mode, BSOD using last known good configuration. You’d think that I’d be able to run system restore or roll back the patch somehow, but the recovery console was no help. To add insult to injury the last Ghost backup image is corrupt! Any ideas?

  18. Raymond Chen says:

    The Recovery Console isn’t actually running Windows. It’s running a minimal pseudo-operating system that knows how to copy files and not much else. That’s why you can’t use SR or anything like that.

  19. Norman Diamond says:

    10/14/2004 4:05 PM Dan

    > While rebooting after the install I get a

    > BSOD and the friggin OS is trying to be so

    > helpful that it doesn’t even allow me to see

    > what the error was, it just reboots.

    Too late for you this time, but in the future you can go into the properties dialog of "my computer" and clear a checkbox so it won’t automatically restart after a BSOD.

    > BSOD using last known good configuration.

    I have the intuitive impression that "last known good" only uses an old registry that was included in the last successful login, i.e. it doesn’t restore other system files that were executing in the last successful login.

    There used to be a purpose to having two installations of the same OS side-by-side in separate disk partitions. Sometimes you could figure out which files to repair manually. But now each installation’s system restore stuff writes restore points in all partitions instead of just in its own boot partition, and it’s loads of fun to look at them and try to guess which restore points were written by which installation. Plus with activation, each installation has too many hardware changes from the other installation even though it’s the exact same hardware on the same machine.

  20. Dan says:

    Norman, thanks for giving me inspiration. The f8 menu does have a "Disable reboot on error" option. (You should have seen me with my digital camera before that :) That was enough for me to see it was a PAGE_FAULT_IN_NONPAGED_AREA error and the system was pointing the finger at PQV2i.SYS (part of Ghost 9 & Drive Image). Simply disabled that service from the recovery console (I guess it is good for something) and I’m up and running again. Now we just have to figure out why… oh why.

  21. Rob Meyer says:

    How about instead of just a single error message at boot, it creates a taskbar notification that warns you ever 5 minutes that your system is in an inconsistent state and offers to kick off the recovery procedure for you.

    While I can see that recovering automatically is problematic, a single, cancelable error message at boot does not seem like nearly enough warning that your system is totally hosed…

  22. Raymond Chen says:

    "…it creates a taskbar notification …"

    This means running a program, and John noted, at the time the problem is detected, the registry is not available, so you can’t write a program into the "Run" key or drop a shortcut into the Startup folder (you need to read the registry to figure out where the Startup folder is).

  23. Rob Meyer says:

    Ah, I didn’t notice that part of his posting. You’re really painted into a corner at that point then.

    Heh; does windows still read (has read at this point in the boot) win.ini/system.ini? How about dropping the notification program in there? :-)

    Or, what if the very first thing the SP2 installer did was set a recovery notifier as a run program. Then it started installing. If it completely installed, it removes the program. If it fails and reboots during, then next time the system boots and a user logs in, they get the warning message.

  24. David Candy says:

    Chkdsk has no problems with this scenario. It creates a text file and after boot the text file is moved to event viewer.

  25. Lorena says:

    I’m trying to fix a friend’s computer and this is just what happened to her computer.

    I think this post will be really useful but there’s one thing… I find many SP2 Hotfixes but I don’t find "Windows XP Hotfix – KB834707" what can I do in this case? Please help me, or my friend will die without her computer! :(

  26. John [MSFT] says:

    Lorena: If SP2 is present in the add/remove programs, go ahead and "uninstall" it, then reinstall SP2.

    Best way so far to determine if a computer is in the partial install state:

    Add/remove programs contains the Windows XP SP2 listing, but key files (e.g. lsass) are lower than build 2600.2180 indicating SP2 is not installed.

  27. Charvy Alacar says:

    After uninstalling "Windows XP Hotfix – KB834707" the computer keeps restarting. It shows the initial black screen and restarts it 3 seconds later. Any advice would be much appreciated. Thanks.

  28. Richard Zorge says:

    I have this weird problem.

    I have installed one of the earlier betas of SP2. And my computer works rather fine. However, when the final SP2 arrived and I decided to install it, I figured that my Add/Remove program list does not contain reference to Service Pack 2. I cannot install final SP2 without removing the beta. But I cannot remove beta, because it is not listed. What can I do? Any advice is greatly appreciated.

  29. i did the necessary items asked, and when i rebooted after re installing sp2 i got the same error message, only this time when i went back to do step one in the debugging process which is removing hp hotfix kb834707 a error message popped up saying " the system cannot find the file specified" then " kb834707 was not uninstalled" i dont know what to do know since it wont unistall it for me to do that whole process all over again! help!

  30. Vincent Chen says:

    I’ve got the same problems as Sirovica described above. Will installing the SP2 on a CD help?

  31. Toby Acton says:

    Yes I have the same problem as Sirovica and Vincent Chen above

    Any ideas PLEASE??!!

  32. Jay Kim says:

    i followed step 11 and i can’t find SP2 entry in the list.

    i checked windows version and it read – version5.1{build 2600.xpsp1. 020828-1920 : Service Pack 2} – first sp1, second sp2????.

    How can i remove sp2 manually?

    Is there anything else solve this problem?

  33. Raymond Chen says:

    I don’t know what is going on; I was just repeating the analysis of the Service Pack team. The version number is very strange; it sounds like you still have a mix of Service Pack 1 and Service Pack 2. Perhaps there were other updates that you installed during the mixed-up state that installed SP2 some files?

  34. Lorena says:

    Thank you guys, specially John for your help! It worked perfectly and now I’m uninstalling the rest of the SP2.

  35. damon says:

    Thanks guys. A friend of mine called me and asked for help with her pc. I can’t believe Microsoft doesn’t have this fix posted on their website.

    Thanks again for your fix, it was greatly appreciated.

  36. ok people lets get a move on i still am gettin NO HELP :(

  37. Jeremy says:

    Thank you. You do amazing work. Glad I am subscribed to the feed. Now, if I could just get my girlfriend to read error messages before dismissing them.

  38. Toby Acton says:

    I Have been trying to get into the Recovery Console but I do not know the Administrator Password – what can I do?

  39. JAy Kim says:

    if you didnt set it up

    just hit enter

  40. Vincent Chen says:

    Ok. I’ve also followed Sirovica’s steps and it didn’t work. And it created one more new problem… corrupted the winlogon.exe. Even when I use back the old winlogon.exe, it didn’t work :(

    am going to do the painful thing of reinstalling winXP :(

  41. vincent Chen says:

    Ok. I’ve finally found something on MS website on how to deal with this problem.

    But it’s too late or me. I’ve started reinstalling XP :(

    Good luck for those are still trying to recover your system. Sigh… Now I’ll disable auto update feature…

  42. dont disable it…just read the damn popups before you close em, make it a habit….

  43. 1. Use the Windows XP Setup start-up disks or the Windows XP CD-ROM to start your computer.

    2. At the "Welcome to Setup" screen, press R, and then press C to start the Recovery Console.

    3. Type the number for the appropriate Windows XP installation, and then type the Administrator account password.

    4. Type the following commands, and then press ENTER after each command:


    cd windowssystem32

    ren winlogon.exe winlogon.old

    ren msgina.dll msgina.old

    ren shell32.dll shell32.old

    ren shlwapi.dll shlwapi.old


    cd servicepackfilesi386

    copy MSGINA.DLL c:windowssystem32

    copy SHELL32.DLL c:windowssystem32

    copy WINLOGON.EXE c:windowssystem32

    copy SHLWAPI.DLL c:windowssystem32

    Note If the DLL files are not in the Servicepackfiles folder, you must expand these files from the Windows XP installation CD-ROM and copy them to the System32 folder. To expand these files from the Windows XP installation CD, follow these steps: a. Put the Windows XP installation CD in your CD-ROM or DVD drive.

    b. Type the following commands, and then press ENTER after each command:

    expand CD_Drive_Letter:i386MSGINA.DL_ C:windowssystem32

    expand CD_Drive_Letter:i386SHELL.DL_ C:windowssystem32

    expand CD_Drive_Letter:i386WINLOGON.EX_ C:windowssystem32

    expand CD_Drive_Letter:i386SHLWAPI.DL_ C:windowssystem32


    cd windowssystem32

    ren *.dl_ *.dll

    ren *.ex_ *.exe

    5. Type exit, and then press ENTER.

    ok i even did this and it wont help, this is what the microsoft help team sent me. I still get the error message, and it still wont let me delete HPHOTFIX KB834707.


    Note You cannot remove Windows XP SP2 if you installed the service pack on a computer that already had Windows XP SP2 installed. The removal program will roll back to the version of Windows that existed before your installation. In this case, the program will roll back to the first installation of Windows XP SP2.

    Use any one of the following methods to remove Microsoft Windows XP SP2 from your computer: • Use the Add or Remove Programs tool in Control Panel

    • Use the hidden $NtServicePackUninstall$ folder

    • Use the System Restore process

    • Use Recovery Console

    Important We recommend that you use the following methods in the order that they are listed.

    Use the Add or Remove Programs tool in Control Panel

    1. Click Start, click Run, type appwiz.cpl in the Open box, and then click OK.

    2. Click to select the Show Updates check box.

    3. Click Windows XP Service Pack 2, and then click Remove.

    4. Follow the instructions on the screen to remove Windows XP SP2.

    Use the hidden $NtServicePackUninstall$ folder

    1. Click Start, click Run, type c:windows$NtServicePackUninstall$spuninstspuninst.exe in the Open box, and then click OK.

    2. When the Windows XP Service Pack 2 Removal Wizard starts, click Next.

    3. Follow the instructions on the screen to remove Windows XP SP2.

    Use the System Restore process

    1. Click Start, click Run, type %SystemRoot%System32restorerstrui.exe in the Open box, and then click OK.

    2. Click Restore my computer to an earlier time, and then click Next.

    3. Click the date that you installed Windows XP SP2, and then click Installed Window XP Service Pack 2 in the Restore Point box.

    4. Click Next, and then follow the instructions on the screen to remove Windows XP SP2.

    Use Recovery Console

    Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

    If you cannot successfully remove Windows XP SP2 by using one of the previous methods, follow these steps: 1. Insert the Windows XP startup disk in your floppy disk drive or insert the Windows XP CD in the CD drive or in the DVD drive, and then restart your computer.

    Note When you receive the following message, press a key to start your computer from the Windows XP CD:

    Press any key to boot from CD

    Note Your computer must be configured to start from the CD drive or the DVD drive. For more information about how to configure your computer to start from the CD drive or the DVD drive, see the documentation that came with your computer or contact the computer manufacturer.

    2. When you receive the Welcome to Setup message, press R to start the Recovery Console.

    NoteMultiple options will appear on the screen.

    3. Select the Windows XP installation in question.

    Note You must select a number before you press ENTER, or the computer will restart. Typically, only the 1: C:Windows selection is available.

    4. If you are prompted to type an administrator password, do so. If you do not know the administrator password, press ENTER. (Typically, the password is blank.)

    Note You will not be able to continue if you do not have the administrator password.

    5. At the command prompt, type cd $ntservicepackuninstall$spuninst, and then press ENTER.

    Note After you complete this step, you cannot stop the removal process.

    6. At the command prompt, type batch spuninst.txt, and then press ENTER.

    Note The Spuninstal.txt file appears. As the file scrolls down, you will see errors and files being copied. This is normal behavior.

    7. After Windows XP SP2 is removed, type exit, and then press ENTER.

    8. Restart your computer in Safe Mode. To do this, press F8 as the computer restarts.

    Note After you restart, the system may lock up with a black screen. (Your mouse will work.) In this case, restart again by turning the computer off and then back on. The second restart will let you to log on.

    9. When your computer restarts, Windows Explorer (Explorer.exe) does not run, and the Windows icons and the Start button are unavailable. To resolve this problem, follow these steps: a. Press CTRL+ALT+DEL to start Task Manager.

    b. Click File, and then click New Task (Run…).

    c. In the Open box, type regedit, and then click OK.

    d. Locate and then click the following registry subkey:


    e. On the right side of the viewing pane, right-click ObjectName, click Modify, type LocalSystem in the Value data box, and then click OK.

    f. Restart your computer

    10. Use one of the previous methods to remove Windows XP SP2 from your computer.


  45. Lynda says:

    Oh dear – got the problem above and followed the directions – but the "Running process after uninstall" has taken more than 3 hours. Can I just click finish? How long does the process last for the rest of you?

    "Click on it and click the "Remove" button. It will take some time to complete. Once the "Finish" button is visible, click on it and reboot your system. If you get messages about additional software or hotfixes installed, you can safely ignore them."

  46. Mike says:

    A very similar thing happened to me. Read my account at

    The strange thing is that Windows XP SP2 on a fresh install of XP fails for me 50% of the time.

  47. Raymond Chen says:

    The winlogon replacement suggestion is a total red herring. The SHCreateThreadRef problem has nothing to do with winlogon. And rolling back shlwapi will only make the problem worse, not better.

  48. Max Beran says:

    I was getting partial installations as described above (and committed the dreadful sin, also referred to in many mailings here, of ignoring it). By trial and error I learned that the problem was that I had left the virus checker and the Firewall enabled. I suspect that one of these had intervened at a point when I wasn’t watching and the computer got fed up waiting so put itself to sleep. Moral – disable firewall and virus checker. Does Microsoft say so explicitly in any of its istructions? I didn’t notice it anywhere.

  49. Brent says:

    I am in the midst of this situation too and have tried the suggestions and have run into problems.

    First I do not have: Windows XP Hotfix – KB834707. I noticed Lorna above had that problem so she just uninstalled the whole Windows XP Service Pack 2. I can’t accomplish that however. I tried on the add remove and during the 4th step of the wizard I get the following error messages:

    "System can not find the file specified" and then I get "Service Pack 2 was not uninstalled".

    I also tried removing using the $NtServicePackUninstall$ and ran into the exact same problem.

    As further information here are all the SP2 files on my computer in the Add/Remove program section:

    Windows XP service pack 2
















  50. Jeanne says:

    My daugther has this problem, but when she tries to type in the appwiz.cpl, task mgr locks up and won’t accept input from the keypad or mouse.

  51. Rachel says:

    I have the same problem as Dijana, and I’m trying to follow the directions that includes using the recovery console.

    I’m having problems making my computer start from the CD drive. How do I do that?

    By the way, Dijana, which method did you use to solve your problem?

  52. John [MSFT] says:

    I don’t think Raymond’s blog is the best way for ongoing troubleshooting…so this will be the last post here.

    Let’s move troubleshooting questions & solutions to the Microsoft Windows XP General Newsgroups

    If you need direct help with XP SP2, start here: If you don’t find direct help in the links, in the top right corner is a link to contact product support – the professionals that can directly help. If you are having serious problems, they can almost always help.

    One last tip: If you can’t run AppWiz, try typing one of these into the Task Manager File/Run box:

    To remove the IE update:


    to remove SP2:


  53. Edwin says:

    I have follow all the procedure, uninstalling and reintalling the service pack 2, and my computer is OK now.

    Very smart tips (and also who write that tip)


  54. Lynda Shen says:

    This blog is a "life-saver" for me.

    Well, the problem all began because while installing the SP2, my system crashed. But since it was able to restart – I decided to put off uninstallation of SP2 because I needed the computer badly. Hardly did I know that that was the worst decision I’ve ever made. Somehow, KB834707 came and updated itself on my computer and asked for a reboot. I had always installed many software and many Microsoft security patches without any incidents – so that gave me a false sense of security. I did not fully backup my drive. I only backed up the most important thing.

    After reboot, I saw the message "The procedure entry point SHCreateThreadRef could not be located …." and thought … can’t be that bad. Surely this thing CAN revive itself. I was so wrong – until I found this weblog.

    I tried the steps and was able to partially get rid of KB834707 when the system crashed again. So I rebooted the computer and this time the computer looks fine – and I quickly uninstalled the SP2. It uninstalled without incident … but the whole process already took me 8 hours (because I mistaken the crash for the uninstallation)!!

    The next morning I turned on my computer. WOW! What a fright I got! It started searching for drivers and installing them and everything on my monitor looked really primitive. I had to reconfigure the monitor and adjust the settings of my Network connections. To cut the long story short, it was both a mentally and emotionally exhausting experience.

    Finally I was able to log on the internet and post again. But I’m not sure how my other programs are doing. It was a very terrible experience … and the SP2 update is still pestering for an installation. I shall wait until I get a thorough and full backup before toying around with this thing again.

    My computer is now up and running fine though a bit slow even after defrag. It’s still a little unstable.

    SP2 is definitely a big PATCH and will land you on a bad patch if you’re unlucky enough. I’m glad that the posting on this weblog is useful in helping resolve the problem. Thank you.

  55. Hippycat says:

    Hi! I Just wanted to add my little story to this here blog. Tonight as I hurrily tried to calm down my friend on the phone (who was begging for help with this same problem – background with no desktop icons or task bar) I googled SHCreateThreadRef error. I found an awful lot of web comments (forums, etc) regarding this issue have appeared in just the last few days. I take this to mean that this is a very recent problem that nailed way too many people, including my friend. Unfortunately among the other sites there is little in the way of actually fixing this problem. Most answers were of the "try system restore" or "insert XP cd and repair" variety, which really isn’t an option with this particular problem (it didn’t work for my friend anyway).

    Then I got here. I read verbatim your fix over the phone, and… he got it fixed on the first try!!! 100% OK now!!! I can’t thank you enough for posting this! For helping to get my friend’s pc back up and running, he claims that all the drinks are on him tomorrow! I can’t help but feel that he owes you a couple too! Again thanks! AND CHEERS!

  56. James Mack says:

    Just received a call from a customer with this problem, put in the error into google, got this webpage, ran through the instructions, fixed it first time! Thanks a lot!!

  57. Liz says:

    I am having the same problem as Jeanne above– I get to task manager and cannot type, backspace, delete, use the mouse, etc. It will not accept any info, and just goes to blank and freezes. Help?

  58. Jürgen Priem (Belgium) says:

    We got two pc’s at the same time from two customers. So that was a bit weird. After a lot of searching I finally found this site. I followed the steps and they both work now.

    Thanks a lot!!!!

  59. AK says:

    I am do Step 1 to 7, sucessfully. I can logon again!

    Now work on the remaining step.


  60. Jeff says:

    I have attempted to follow the instructions listed at the beginning of this thread. Unfortunately, everytime I try to remove KB834707 it looks as though it is successful and reboots my machine, but when I try to log back in I still get the same error. One difference I may have versus the rest of you is that I am running the tablet pc version of XP. If anyone knows whether the tablet pc version is complicating things or has a solution, please let me know. (btw: they don’t ship installation cd’s of tablet pc XP… I just have the autorecover cd’s that format my drive)

    Thanks for any help!

  61. BJ says:

    Thanks a lot to whomever posted the solution of this problem. After carefully followed the suggested instructions, I had my Laptop back to the condition before I installed the SP2.

    It had been an unproductive and frustrated moment being unable to do anything with My Laptop. Again, Thanks!


  62. Frank Brebels says:

    Thanks, it worked perfectly, i’m up and running again.


  63. Ari says:

    Thank you sooo much. It worked!

    One thing to add is after you remove xp2 the system has to restart two or three times to reimstall all the system drivers.

  64. mehri says:

    when i go through the task manager and procceed the steps when i type control appwiz.ap1 i get the above message .what shall i do?

  65. mehri says:

    when i go to the procedure after step 4 ti get this message: Control exe.Entry not found . THe procedure entry point SHRegGetValueW could not be located in th dynamic link libary SHWAPI.dll what shall i do.

  66. BobR says:

    Outstanding! This was a real issue – but with your instructions I fixed the problem. Again, Outstanding and Thanks!! Please keep posting this kind of material – it is so helpful when you need it…

  67. p1g9y says:

    i followed the directions up to number 7 and i stopped receiving the error message but i cant seem to find the entry windows xp service pack 2…. has my problem really been fixed?

  68. Kevin says:

    When I attempt to remove KB834707 a message appears which states: The system cannot find the file specified. Therefore, I cannot uninstall KB834707. Any advise on what I can do next?

  69. eddie says:

    Thanks!! This solved my problem. Wasted the entire day yesterday trying to figure this out. I’ll be a hero today!!

  70. Marcelo Negrisoli says:

    Great !!!!!!!!!! thanx !

  71. AJ says:

    This site came up in google before did – running through the official instructions now. Thanks all for getting the information out there :-)

    <fingers crossed>

  72. TC says:

    This was a TREMENDOUS time saver – Thanks for getting this out there. I ran through this before MS posted it’s KB and it worked great! I just got a little nervous with the list of programs that may not run after SP2 uninstall contained every program on the PC twice over & and when many devices weren’t recongnized after on the reboot after SP2 removal — but in the end everything was back to normal.

    I find it very impressive to see MS basically quote this procedure verbatim in their KB – good work!

  73. Raymond Chen says:

    It’s not surprising at all. The same people wrote these instructions and the KB article.

  74. Norman Diamond says:

    Has anyone written a similar set of instructions for uninstalling Windows Server 2003 SP1 beta build 1218? I couldn’t find any. But I also couldn’t find reports of anyone else unable to install the Windows 2003 version of .NET Framework 1.1 SP1 critical update. I wonder if the null pointer dereference, which crashes the installer of the .NET Framework 1.1 SP1, might be a result of Windows Server 2003 SP1 beta build 1218 having failed to uninstall itself properly even though it looked like it was installed.

    Furthermore, I don’t know what IDW is, but it’s writing logs of failures to access hostnames on a local LAN which don’t exist on my local LAN, and it seems to think that build 1218 is still installed.

    By the way, the reason I uninstalled build 1218 was because it added bugs (blacking out the entire screen) while not fixing any of the bugs that had been bothering me (e.g. Windows Explorer bugs that were also added in Windows XP but mostly fixed by Windows XP SP2). Furthermore the instructions for build 1218 say that it will have to be uninstalled before installing the real SP1, if the real SP1 ever gets released.

    Of course all of this isn’t really your fault, I’m just wondering if there’s a fix for this possibly failed SP uninstallation, very similar to the one that you’re posting about.

  75. ajay says:

    its superb

  76. Paul says:

    Thanks man. This weblog really helped. I was working for hours on this problem. Keep up the helping. Props to you man.

    -Paul Kim

  77. Brandon says:

    Flawless fix, thankyou much. Why is it all crossed out?

  78. Rachel says:

    Previously posted by Kevin:

    "When I attempt to remove KB834707 a message appears which states: The system cannot find the file specified. Therefore, I cannot uninstall KB834707. Any advise on what I can do next?"

    I have the same problem as you. I do not know what to do either.

  79. Dale Edawrds says:


    I’m a bit of a newbie at all this and hope I’m not voilating any etiquette or breaking any rules by placing my question here but I’m kind of at my wits end and really don’t know where else to go. I gusess you could say that I’m basically begging at this point.

    We have Virtual PC for Mac (6.1). I’m hoping someone might know of a Web URL or phone number where can I get help. We need to reinstall VPC on an eMac but have lost track of the CD sleeve that had it’s Serial number on it.

    I’ve tried calling a couple of different numbers posted on Microsoft’s web site but in one case was given what turned out to be a "product key" not a "Serial Number" and in the other case was told, besides costing $35.00, I must also provide the Serial Number (the very thing I’m needing) up front before they would talk to me.

    I’m sure there is some way for me to hook up with the correct department I just don’t know how. If anyone can provide me with a starting point for finding some help then I’d be eternally grateful.

    Yours truely,


  80. alekos says:

    That is awesome!!!

    I worked on it for 3 hr and nothing

    and your solution fixed in 5 minutes


  81. Linux/Mac user says:

    Windows is a piece of trash…I cant wait til Microsoft loses its foothold

  82. Shiulude says:

    Client uninstalled SP2 when confronted with "OE has denied….." Talk about not reading the help….

    Anyway, getting the same shcreate, and have re-expanded the 4 files, but no change.

    I can run the task man. But there is no SP2 or 34707 on this PC. Hmmmmm

    There are however, 823980, and 835732, and neither one will get out.

  83. Ann says:

    If the Windows XP Hotfix – KB834707, fails to uninstall (still shows up in your apps list) and/or the uninstall of Service Pack 2 fails, it’s because you probably attempted to install SP2 more than once (maybe it failed once and then you tried again). Microsoft notes, "You cannot remove Windows XP SP2 if you installed the service pack on a computer that already had Windows XP SP2 installed. The removal program will roll back to the version of Windows that existed before your installation. In this case, the program will roll back to the first installation of Windows XP SP2."

    MS has the fix for this documented:“> Only the last option to uninstall using Recovery Console from CD worked for me.

    Important notes:

    -the batch file took about 15 minutes to run

    -don’t forget to eject the CD after the batch file finishes so you can reboot to safe mode

    -you still have to complete the steps of uninstalling kb834707 and xp2 using the steps outlined in“>“>“>

    It didn’t totally work for me. Here’s what DID work:

    -Use the Recovery Console to uninstall using your XP CD (“>

    -After completing ALL the steps, reboot normally and remove the Windows XP Hotfix – KB834707 (“>“>“>

    -After removing JUST the Hotfix, reboot into Safe Mode

    -Use System Restore to rollback to the Restore Point right before the SP2 installation (the SP2 installation creates this Restore Point automatically)

    -When the System Restore reboots your machine (done automatically), let it reboot normally

    -Open the Application Uninstall program and remove SP2 (“>“>“>

    This whole process took me almost 1 1/2 hours to complete (the System restore and SP2 removal wizard takes about 30 minutes each)

  84. Scott Hanselman muses about what he terms &quot;Conversational Error Messages (CEMs)&quot; in Microsoft Max. I have been on the authoring end of many an error message, so I speak fluent error-message-ese. That said, my first contract job at Microsoft was on the …

Comments are closed.

*DISCLAIMER: I DO NOT OWN THIS CONTENT. If you are the owner and would like it removed, please contact me. The content herein is an archived reproduction of entries from Raymond Chen's "Old New Thing" Blog (most recent link is here). It may have slight formatting modifications for consistency and to improve readability.

WHY DID I DUPLICATE THIS CONTENT HERE? Let me first say this site has never had anything to sell and has never shown ads of any kind. I have nothing monetarily to gain by duplicating content here. Because I had made my own local copy of this content throughout the years, for ease of using tools like grep, I decided to put it online after I discovered some of the original content previously and publicly available, had disappeared approximately early to mid 2019. At the same time, I present the content in an easily accessible theme-agnostic way.

The information provided by Raymond's blog is, for all practical purposes, more authoritative on Windows Development than Microsoft's own MSDN documentation and should be considered supplemental reading to that documentation. The wealth of missing details provided by this blog that Microsoft could not or did not document about Windows over the years is vital enough, many would agree an online "backup" of these details is a necessary endeavor. Specifics include:

<-- Back to Old New Thing Archive Index