Windows 2000 total slipstream

Archived August 10, 2009, no further updates

Windows 2000 will not have any new Service Packs, so there is rarely any need to develop new content. HFSLIP will always support my fileset.

This is only for Windows 2000. For XP and 2003 visit the forum at MSFN.

I have always been tutorial-heavy, because I think it's more valuable for people to learn. What you will read has been described as "mind-numbingly thorough" and that means I've reached my goal.

I will provide all of the files you need to do this. After putting my files into FDVFILES, you do NOT need to do much more than read and learn! We're going to do all of the following in one tutorial:

Before we begin

It's not required, but it helps a lot if you:

You should know that although using HFSLIP is not required, I highly recommend that you do.

Exroidal The Windows Wizard has tips for advanced users throughout.
Beginners can safely ignore what Exroidal has to say.

Step 1

Create a new folder on D:\ called HFSLIP. This folder must not have any punctuation in its name, so don't decide to get creative. (You could call it WIN2000, but don't call it _HFSLIP or HFSLIP!2K or something).

Unzip the HFSLIP archive contents to D:\HFSLIP

Double-click on hfslip-x.x.x.cmd (the x's are the version number)

You'll see a DOS box flick on and then close immediately. What HFSLIP has done is to create several subfolders and then terminate automatically.

Copy the i386 directory from the Windows 2000 CD to D:\HFSLIP\SOURCE

Copy CDROM_IP.5 and CDROM_NT.5 from the Windows 2000 CD to D:\HFSLIP\SOURCE

Step 2 (optional)

Ignore this step if you already have SP4 slipstreamed.

Download Windows 2000 Service Pack 4. I have to use a Google link because Microsoft changes the download page every week. You may download your native language version as HFSLIP is multilingual. Note that HFSLIP is compatable with the English-only 'unofficial' Service Pack 5 if you really had a burning desire to use it. By now the USP is so out of date, though, that I'd recommend you steer clear of it.

Put SP4's .EXE file into the HF folder and go to Step Three.

If you want to do the slipstreaming of Service Pack 4 yourself, follow this procedure:
1. Move i386 to the root of the D: drive
2. Create a new folder on D:\ called SP4
3. Save the Service Pack to D:\SP4
4. Open a command prompt by going to Start/programs/accessories/command prompt
5. Type
D:\SP4\W2KSP4.EXE -x
6. When asked which directory you want to expand to, specify D:\SP4.
7. Type
8. When it's done, copy i386 back to D:\HFSLIP\SOURCES

By using the root of D, UPDATE will update files in D:\i386. (The UPDATE.EXE command is hard-coded to look for an i386 directory.)

If you get an error, that means that either you put the Windows 2000 i386 folder in a subfolder on D: or you typed the command wrong. Be sure that you copy i386 to the root of the drive, and do not type -s:[drive]:\i386\ because UPDATE would be looking for your Windows 2000 files in [drive]:\i386\i386.

Step 3

Populate the HF folder
Start downloading all of the hotfixes you need and save them in the HF folder (D:\HFSLIP\HF). You can find Windows 2000 hotfixes here.

If you are using my fileset, don't bother with the following hotfixes, they're a waste. Don't even look for them. If you can't find them, GOOD.

The HF folder can take Type 1 and Type 2 Hotfixes as well as MSI installers. Here's what it can't take: hotfixes for both Internet Explorer 5 and 6. Think about it: combining hotfixes for two different versions of IE is only asking for problems. Also, since you're going to slipstream DirectX 9, get DX9 hotfixes, but don't put a hotfix for DX7 in this folder. What I'm saying here just makes sense to you, I hope!

Do not rename the files. (However, it is ok to put a prefix to the filename like Z_ in front in case you want to sort some hotfixes.)

Please note that links to files with ENU in them are English language updates only. (Remember that HFSLIP supports languages other than English, but finding the appropriate Hotfixes is up to you!)

Rootsupdate may be placed in HF as well. Microsoft claims that Rootsupdate isn't just used with IE, it is also used for some program installers. I have no idea if that's true.

Windows Media 9/10 Codecs (optional)
Download the WindowsMedia9-KB891122-x86-Global-ENU and extract the contents usinf the -x switch to get the WMFDIST.EXE file, then place it in the HF folder and discard the WindowsMedia9-KB891122-x86-Global-ENU.exe file. HFSLIP will slipstream WM9 codecs, but not the player, into Windows. This EXE will also cause the Windows DRM (Digital Rights Management) files to be updated as well. There are some software packages that call the DRM dlls, like Goldwave. (Goldwave is great!)

Step 4

Populate the HFTOOLS folder
Download the following and put them in HFTOOLS.

ModifyPE (unzip it, and copy the executable (modifype.exe) to both HFTOOLS and your own C:\WINNT\system32. (Here is another source for

Mkisofs.exe (this version does not need Cygwin, or you can use Mkisofs.exe and Cygwin) and put it into HFTOOLS so that HFSLIP can make an ISO for you. You may also use CDImage.exe, if you can find it . Note: to find a version of Mkisofs.exe that does not need a Cygwin DLL, search Google for "Mingw32 mkisofs.exe"



Extract.exe (makecab.exe is in here, and is handy but not required).

Step 5 (optional)

Integrating Application Add-Ons
Here is where we put those nifty silent installers. Filenames here must have 8.3 formatting, and must be without spaces or punctuation.

The HFSVCPACK Directory - For installing Self Extracting Silent Switchless Installers (.REG tweak files, .INF files, CMD files)

The HFSVCPACK_SW1 Directory - For MSI files (except Microsoft XML installation files, which go in HF)

The HFSVCPACK_SW2 Directory - For installing programs packaged with /Q:A /R:N switches, like TweakUI 1.33.

Here is how to make switchless installers. RyanVM has some handy installers. Lots of silent switchless application info is listed here.

Step 6

Prepare DirectX 9
This method of slipstreaming DirectX9c will actually slipstream DirectX into the OS. It will NOT be added using /integrate. Please note that the way the scripting works, your Windows 2000 install will not have worthless pictures of joysticks and lightguns. (Yeah, that's right -- the bloat in the DirectX package is simply pictures of your gaming input devices.)

Download the DirectX9c redistributable installer, and extract the .CAB files from the EXE file (such as with 7-Zip, Winzip or Winrar). You'll have to validate if you want to download from Microsoft, so go here if you want to avoid Windows Genuine Annoyance. Or, grab DirectX9 from here. If you think you must use the DirectX9c Microsoft keeps updating, use all of the cabfiles except the ones with "64" in the filename. Hey, it's your computer; if you really want to load it down with crap, be my guest.
Place the following two files into the HFCABS folder:

By the way, if you use nLite later, you'll need to read all the way to the end to see what files to put into the nLite "Keep" box to avoid errors!

Download hotfixes
Here is a link to my hosted list of Win2k hotfixes.

Step 7

Make a decision about Internet Explorer.
You need to decide now whether you will be using IE 5.01, IE 6.0, or not using IE at all. You will have to download different files depending on which version you are using.


Preparing Internet Explorer 5.01

Put MSIE 5.01 hotfix files into your HF folder.

You are done with this step, skip to step 8.


Preparing Internet Explorer 6.

Since you've decided to add IE6, do not download any hotfixes for Internet Explorer or Outlook Express versions 5.x, only download fixes to version 6.0 or higher. (If you want to integrate IE6 and you have IE5 patches, be sure to delete those IE5 patches!)

Direct download for Internet Explorer 6 here. See Exroidal the wizard's tip below to download IE 6 from Microsoft.

Place the IE6 source CABs in HFCABS folder.

The CABs that make up Internet Explorer that the batch file uses are these:

My IE files are stamped 10/22/2004. Don’t worry if your file dates vary. You do not have to delete the extra CAB files that you don’t need.

Put Internet Explorer 6 hotfix files in your HF Directory.

Just in case you were tempted not to use the Post SP4 Rollup, I have to tell you here that the Rollup is required for slipstreaming IE6.

If downloading Internet Explorer 6 from Microsoft:
Download Internet Explorer 6.0 SP1
You cannot just double-click the IE6 executable you downloaded.
Open a command prompt
D:\ie6setup.exe /c:"ie6wzd.exe /d /s:""#E"""
There are an unknown number of quotation marks in that command. In order to make sure that you get this step right, you might want to copy that text, and paste it into your Start/Run box. Various websites and Microsoft have quotes that don't agree. Keep trying to add or subtract quotes. What can I say? No one seems to know. I got that string from Microsoft and as of July 2005 it just stopped working for me.
You will be given a choice of platforms to download for. You only need to select “Windows 2000 and Windows XP”

You are done with this step, skip to step 8.


Removing IE (and a LOAD of other junk) completely

Get the required IE 5.01 hotfix files here (go to Updates for MSIE when keeping MSIE 5.01 SP4). Put the MSIE 5.01 hotfix files into your HF folder. (Yes, we are using IE 5.01 hotfixes in order to get updated files like SHDOCVW.DLL.)

Download my Internet Explorer Removal Files. Pick one: Set 9 (most recent) here, OR Set 8k (for those who had better luck with the 8 series) here (temp unavail. Ask me if you want it).

(Note that some virus scanners might say that the SFC.DLL provided is infected with the "Banker" Trojan for example, or that IEXPLORE.EXE is infected. They aren't, these are false positives.) Save the file to D:\ and unzip its contents to D:\HFSLIP\FDVFILES

Although you could, there is no real reason to slipstream IE6 if you are using my IE removal files (unless you use Acrobat Reader 8). The updated IE6 system files have Zone settings that don't add anything of any value. Also, the File/Open Containing Folder in the Explorer search results box will not work because of changes MS made to system files.

Let me repeat that: you will be tempted to slipstream IE6 and use IE6 hotfix files when removing IE, because you'll think that the newer files have more functionality in the OS. Unless you use PCAnywhere or Acrobat 8, they DON'T. So it's your option.

Disbelievers: See where I said "Zone settings" above? I have had that text there for a few years now for a reason. If you don't know what that is, you can look it up. Why is it incumbent upon me to explain that Windows checks Zone settings constantly during loading, copying, saving, etc? Why do I need to explain how Zones and ActiveX patrolling work just so you can comprehend how Windows would be checking file Zone origins and permissible ActiveX CLSIDs every time you manipulate a file? The information is out there, most especially in the notes in KB articles and in the DLLs themselves when viewed with ResHacker.

Step 8

Making a boot sector, and making sure we're good so far.
Whether you're making an actual install CD or just an ISO to use later, you'll have to have a boot sector. You can download them from lots of places on the Internet, or if you leave your Windows 2000 CD in the drive when running HFSLIP later, it will extract a boot sector image (using BBIE.EXE automatically) for you. That TommyP, he thought of everything, didn't he? If, for whatever reason, you don't have a Windows CD on hand but you do have a boot sector file, rename it to boot.bin and put it in HFTOOLS.

Let's make sure you have everything right so far. Your SOURCE directory should look like this (don't forget the marker files ending in .5). If you have already slipstreamed SP4, then CDROMSP4.TST will be there. If you have NOT yet slipstreamed SP4 and are planning to have HFSLIP do it for you, then this file will not yet be present. (Thanks PMikeP)

Step 9 (optional)

Add some necessary new and replacement files.

This is optional, you do not have to have it. You can create your own, or use my WINNT.SIF which comes in my fileset. If you're not using my fileset, get or make this file and put it into D:\HFSLIP\REPLACE
Free tip: life seems to go better with WINNT.SIF, so unless you need to hit F6 to install a special mass storage driver, I highly recommend using this file. There are many floating around the Internet.

Other modified binaries go into D:\HFSLIP\REPLACE
The contents of the REPLACE folder will be added to the final folder of source files at the end of the slipstreaming process. If you want to overwrite any files, place those files in this folder. Some possible modified files to place here include SFC.DL_ or SFCFILES.DL_, NTLDR and NTDETECT.COM from Windows XP, etc etc. You MUST NOT put a modified SYSOC.IN_ here!

You've probably heard about the CPUIdle issue in HALMACPI.DLL with the Post SP4 Rollup. This is fixed with HFSLIP, and in my fileset as well.

If you dual-boot Win 2k and XP or 2003, you have to put NTLDR and NTDETECT.COM from Windows XP into REPLACE.

Get a browser right now before you forget (Firefox, Opera). If you rip out IE, you won't be able to download a new browser unless you want to use FTP which is a real pain! (You could, I suppose, put the OffByOne mini-browser into an $OEM$ setup, see below)

While you're at it, take this opportunity to download some software that I recommend.

Step 10

Integrate SATA support (if you need it)

Alter (Alexander A. Telyatnikov) has made free for us all a Universal ATA driver which works for Windows NT 3.51, 4, 2000, and XP. It can give full PATA/SATA support (if it matches your hardware).

  1. Do this step no matter what *: Download the file, unrar it, and put the UNIATA.SYS file right into D:\HFSLIP\SOURCE\i386. (You might as well add it to the source so you'll always have it). You could also put it in FDVFILES if you really wanted to.
  2. Do this only if you need SATA support: If you use my fileset, this part is easy. Search for "[uniata]" (with brackets) in TXTSETUP and delete it. By doing this, you make it part of the [HardwareIdsDatabase] section. Now save and close the file.
  3. If you don't use my fileset, click the technical note link below.
  4. If you have your own special SATA driver, click the technical note link below.

* You know what? Just get the damned file and quit being stubborn.

Click here for a technical discussion of driver integration.

Step 11 (optional)

Making an $OEM$ folder

In this step, we'll create an $OEM$ directory and pack it with utilities.

Inside of D:\HFSLIP\SOURCE, make a folder called $OEM$. Inside of it, make another folder called $$. Inside of that, make another folder called SYSTEM32. You now have D: \ HFSLIP \ SOURCE \ $OEM$ \ $$ \ SYSTEM32

In order to make Windows more useful in a variety of ways when it's installed, we need to download a bunch of utilities that will go into the \WINNT\SYSTEM32 directory automatically at installation. Many of these files come in archives zipped or packed along with help files, text files, chm helpfiles, etc. Just unzip each file and delete these nonessential files, then put all of the .EXEs and .DLLs inside of D: \ HFSLIP \ SOURCE \ $OEM$ \ $$ \ SYSTEM32

Here is a sample of my folder and the programs I use.

Please make sure that the $OEM$ folder is in D:\HFSLIP\SOURCE. It should look like this (again, the .tst file is there only if SP4 is slipstreamed already):

Although you should always make a bootable CD, sometimes an older machine's BIOS doesn't let you boot from the CD. You would then have to use a floppy to install, but your $OEM$ files wouldn't copy over. Here is where we solve one of the enduring mysteries of $OEM$ setups.

Q. Why do some people say to put $OEM$ into the root, and some say to put $OEM$ into \I386?
A. $OEM$ in the root is for CD-based installs; $OEM$ in I386 is for floppy disk-based installs. Put $OEM$ both places if you want to be covered for both types of installations. MS deleted the KB on this (wow, imagine that! MS deleted a KB article!!)

So, if you wanted to install your $OEM$ files also when installing from floppy, you'd have to have duplicate file sets in:
D: \ HFSLIP \ SOURCE \ $OEM$ \ $$ \ SYSTEM32
as well as
D: \ HFSLIP \ SOURCE \ I386 \ $OEM$ \ $$ \ SYSTEM32.

Just a reminder... my fileset does not support floppy-based installs. I'd have to cut up DOSNET.INF and I don't feel like it.

Step 12 (optional)

Make a bootable floppy or recovery CD.

In any emergency, you'll need a way to fix things. I recommend both a bootable DOS floppy and a Windows PE CD. For the floppy, you can get one at bootdisk, or use mine based on FreeDOS. For a bootable Windows CD, I use the Ultimate Boot CD For Windows. You'll need Windows XP or that trial version of Windows 2003 to create it. Boot floppies are also useful for BIOS upgrades.

Step 13

For most of you, this is where we finish up. Advanced students have more to read.

If you consider yourself a NOVICE and you want to be done and make a CD or .ISO now, read "Finishing up" below.

If you consider yourself an INTERMEDIATE or EXPERT Windows tinkerer and want more detail on removing Internet Explorer, Outlook, WAB, Fax, etc., continue reading at Step Eleven.

The Beginner's last step - Finishing up
Now run HFSLIP again (for the second time). The process will start to slipstream the hotfixes and integrate the contents of whatever you added in other folders, like DirectX 9c, Windows Media Player, etc. You may see some error messages pass by on the screen when the script is running. Ignore them. This is due to the fact that many worthless binaries are included with each hotfix.

When it's done, Windows is fully slipstreamed in SOURCESS (note the double S on the end) and you will have a date-stamped ISO file. Use it in a Virtual Machine or burn it to CD if you like.

Language issues?
Languages are automatically chosen depending on the source. As long as you put the correct language hotfix in the HF folder, you will not have issues. If you get prompted during installation to report languages, please post a message to the HFSLIP forum so your language can be added to the program.

Other problems?
Inside of SOURCESS, you will find an ERROR_REPORT.TXT file. HFSLIP creates this no matter what -- even if no errors happened. Open this file and read the instructions.

Using nLite after HFSLIP?
(Copied from HFSLIP.ORG). If you plan on using nLite, please do so on the SOURCESS folder after running HFSLIP. Some items to consider:
Do NOT remove sound drivers. If you remove sound drivers, Windows Media codecs won't work.
You have to add some file names to nLite's "keep" box. Please use this utility to generate a list of new files slipstreamed by HFSLIP.

Please note that my fileset does not work with nLite, for the same reason that two mechanics can't work on the same engine at the same time. Either use one or the other, but not both. Nuhi's software is way more versatile than this process, but my process eliminates IE completely. nLite does not, and that's proved simply by launching Regedit and looking at all of the IE Registry keys which give the OS a lot of IE functionality. Does that mean my process is better? Not necessarily.

To those who removed IE
The initial windows shell launch may take about 30 seconds or more to appear the first time you boot. This is a normal, ONE time event . Windows is installing registry hives and registering DLLs, and other binaries. This delay will never happen again. Because Internet Explorer is nothing more than a patchwork of .DLLs and Registry entries which load when the computer boots, you probably noticed that your boot time got cut in half.

For sites that "require" IE, you can change your user agent string in Firefox and Opera to spoof IE 6 running on XP.

Windows Update will be gone, as it was 100% MS HTML engine dependant. Here is how you fix that: XCHM. (Version 1.3 is stable; as of July 2009 I have been told 1.6 is not)

Download Microsoft Update Agent 3 (binary, KB, Google search for when M$ changes the link in 9 minutes).

Did you know that Add/Remove Programs was also MS HTML dependant? I include a replacement for you, but you could also use an uninstaller program like UnClean2 or MyUninstaller, or use appwiz.cpl from Windows NT 4 or from ReactOS.

For Task Scheduler (gone because it opens ports on your machine, remember?) try Freebyte's replacement.

The following tips are courtesy of Mike: We could use more files from ReactOS. Mount the ISO or open it with a program like Daemontools or WinRAR. In it you will see a file called REACTOS.CAB. Extract the following files and add them to to D:\HFSLIP\FDVFILES: appwiz.cpl (if you need it), and hhctrl.ocx. (Mike also recommend using shdocvw.dll, but it didn't do anything, and setting it to use the Mozilla ActiveX control caused Adobe Creative Suite to crash when installing.) As of this writing, the ReactOS HTML subsystem will not work as a drop-in replacement.

Step 14

Getting more technical.

As you read above, we could be done, but there's a lot more to discover, really. The information below is a mixture of basic knowledge such as $OEM$ structure, and some uncommon knowledge, such as illustrated DLL hacking. You'll need a few additional programs. Download and install a Hex Editor, I recommend XVI32 or PE Explorer (PE Explorer is non-free, but it's a 30 day trial).

Did you remember to also put ModifyPE into C:\WINNT\system32? If not, do so now.
(Another source for

To read about the HFEXPERT Folder, click here.

TXTSETUP.SIF and LAYOUT.INF file "protection."
This one is easy. I keep telling people that the reason Windows chokes on some modified INF files like LAYOUT is because it checks file sizes against the list in the LAYOUT.INF file of any file that has an _X in its line. In other words, if we open LAYOUT.INF and TXTSETUP.SIF, and find the line of that file, it reads:

layout.inf = 2,,244801,,,,_x,20,0,0

If you want to modify this file, delete the _X!

layout.inf = 2,,244801,,,,,20,0,0

ZOMG the _X is gone!!! That's all there is to it! Stop making this harder than it is! You might as well take the _X out from the whole file list (but not the whole INF file, because there are some you need to keep, such as under [SourceDisksNames].) Just remove _X from the list of files under [SourceDisksFiles]. This means global replace of ,_x, with ,, (comma underscore x comma with comma comma)

My fileset does this for you.

Disabling Windows File Protection.

First of all, if you're installing Windows for your Grandmother, then disabling WFP is a really bad idea. Think about it. Her system will be screwed up by the end of the week with all sorts of screwed up DLL problems from the software she's downloaded. It was designed not to thwart you, but to prevent software from changing your DLLs on you. WFP is a good thing 95% of the time. Personally, I don't like some piece of shareware replacing, say, OLEAUT32.DLL and other such files, so I leave WFP turned on. But if you really want to disable it, read on.

Windows File Protection in Service Pack 1 disallows the ffffff9d registry hack discovered by Jeremy Collake. Jeremy details how to modify each new version of SFC.DLL on this page.

Shutting off WFP using only two Registry keys
This was an "oops." I set these keys in fileset 8 (now obsolete) and couldn't figure out why WFP stopped working.

HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","SFCDllCacheDir",,"z:"
HKLM,"SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection","SFCDllCacheDir",,"z:"

These keys are optional in 2000, XP, and 2003. Windows already knows where to find the dllcache, you don't need to tell it. But Microsoft created these two keys to let you tell it. And if you give Windows an inavlid path, it won't find the dllcache, a WFP error will show one time in the error log, and WFP will be off. UNC paths don't work (in 2000 anyway). If UNC paths worked, wouldn't it be great to keep all of your files for all of the users in a domain on one server? Nah, that would make too much sense, so Microsoft would never do it.

Shutting off WFP with a hacked DLL
Jeremy Collake created a "generalize patch procedure" to do this which requires an accompanying reg key (see above). A programmer friend of mine created two DLL hacks that just flat out disable SFC, no reg hack needed. Pick one:
1) by creating a totally disabled SFC.DLL, and his method has since spread far and wide to sites I won't even mention (he doesn't mind).
2) by creating a new version of SFCFILES.DLL that is "empty," which avoids having to hack SFC.DLL. Here is the source for the empty SFCFILES.DLL. The idea and initial source for this came from Damian Bakowski, we've just tweaked his source a little. Here is the compiled version ready to drop into i386. I include this in my fileset renamed as "SFCFILES.DL_.OFF" because if you rename it and delete the "off," SFC will be off! Get it?

I'll show you both methods. Below is the classic "Hack the SFC.DLL" approach. By the way, nLite modifies DLLs too. It seems some people think that this is immoral or something. Trust me, it's okay. No one's gonna die because you hacked up some DLLs.

From your Windows 2000 slipstreamed CD, copy (do not move) SFC.DL_ and SETUPAPI.DL_ to D:\

Open a command prompt

Type D:\expand -r s*.dl_ (this tells windows to uncompress all files beginning with "s" and ending with "dl_")

Type del s*.dl_ (this tells Windows to delete the two original files. We don't need them any more.)

Type copy setupapi.dll setupapi.old (this makes a backup copy of the setupapi.dll file.)

Type copy sfc.dll sfc.old (this makes a backup copy of the sfc.dll file.)

Close this command prompt.

To switch an edited SFC.DLL for the one on your machine manually after Windows has been installed, you would have to boot into Safe Mode. INUSE.EXE, Microsoft's own "File-In-Use Replace Utility," does NOT work here. In fact, INUSE won't work anywhere! Unpack the distributable, and you'll see it's an accident by Microsoft. The software is actually a networking driver! F'ing brilliant!

If you're afraid of the space Windows takes up, you can always set the size of the dllcache to one so that it stores next to nothing. Be sure to use the purgecache switch before the cachesize switch or your setting will do nothing. Please do not put "SFCQuota=0" in your WINNT.SIF. Make it anything other than zero. If you set it to zero and you later run SFC.EXE to scan files or rebuild the file cache, YOU CAN KILL YOUR WINDOWS INSTALLATION. The next time you boot, you may get an error message that the machine is unable to find NTOSKRNL.EXE. The Knowledge Base will claim that this is a problem with the BOOT.INI file, but trust me, it is totally unrelated.

Click here to see how to edit SFC.DLL with XVI32, or instead of hacking it, you can leave it alone and use a version of SFCFILES.DLL that is empty. Download this new SFCFILES.DLL and put it in FIX. I got the idea here, but there were several errors in the approach, so a programmer friend re-wrote the DLL for me. Here is the source. In theory, this should work for all future Service Packs, and continue to work in Windows XP and 2003 as well.

Click here to see how to edit SETUPAPI.DLL with XVI32. I provide this file for you in my fileset. This illustration shows the modifications necessary to turn of digital signature checking during Windows setup. The empty SFCFILES.DLL creator made this for me, too.

Make the edits shown, save the file, and then exit the program.

Save the unmodified copy of SFC.DLL (which you named as SFC.OLD, like I told you to above) and put it on your installation CD. Later, if you want WFP back, you can do an exchange in Safe Mode. Put this file in D:\HFSLIP\SOURCESS\i386.

Now we have to fix the headers on the DLLs we modified! This is not optional!

At this point, one or both .DLL files are hacked, and Windows will not install either one without errors, because they will appear invalid. They both have new checksum values from our making edits with a hex editor, and this new checksum value will not match the value stored inside of the file. We need a way to update these checksums inside of these PE (Packed Executable) files, and we do so by using software to change the internal checksum. ModifyPE, with it's -c switch, will recalculate the checksum and store it so that the file does not appear to be corrupt to Windows. Remember, modifype.exe must have been moved to your C:\WINNT\system32 directory after you downloaded it.

Open a command prompt again.

Type D: [ENTER]


Type modifype sfc.dll -c

Type modifype setupapi.dll -c

Type ren sfc.dll sfc.dl_ (not shown. You could use makecab also.)

Type ren setupapi.dll setupapi.dl_ (not shown. You could use makecab also.)

Close this command prompt.

These files will eventually replace the ones in the i386 folder. I say that you could use makecab.exe to compress these files for you first, but there's no reason to. As long as both files end in an underscore, Windows setup will copy them and think that they are simply 0% compressed. (Speaking of which, if most files on your Windows CD were uncompressed and renamed back to their compressed name with an underscore, your setup would be F-A-S-T. Why save space on a CD? It's a freaking CD, who cares?!)

Step 15

Modifying INF files

This is an optional step because you can simply download my zipfile, but I will continue this explanation, however, as if you were changing the files yourself, so you can learn what I did.

Use EXPAND to have a look at the following unmodified files in your D:\SOURCES\i386 directory. These are of particular interest:

AU.INF - Windows Automatic Update, which is hidden by default (see the HIDE settings in SYSOC.INF)
BASICWK.INF - Security Configuration Template
FAXSETUP.INF - Fax services
HIVEDEF.INF - Default registry settings
HIVESFT.INF - Requires one new line for shutting off WFP
HIVESYS.INF - Installs, among other things, hardware settings and services
ICWNT5.INF - Internet Connection Wizard install script
IE.INF - Inetrnet Explorer AND IE-unrelated system files installation (no, you can't just gut this one!)
IEACCESS.INF - IE related, part of program access and defaults
IEFILES5.INF - An old throwback; this is an IE4 installer file
IERESET.INF - IE settings
IEUINIT.INF - IE settings
IMAGEVUE.INF - Image viewer
LAYOUT.INF - Loads all of the Operating System files to disc in preparation for installation
MPLAYER2.INF - Media Player 2 installer.
MSNETMTG.INF - Netmeeting
MSOE50.INF - Outlook Express
MSTASK.INF - Scheduling Agent installation script
NETMSCLI.INF - Installs several services
NT5JAVA.INF - Microsoft version of Java
SETUPP.INI - A file that tells Windows whether or not to ask for the registration code
SHELL.INF - Miscellaneous shell settings
SYSCOMP.INF - File security for many Windows files
SYSOC.INF - The Windows Components list
SYSSETUP.INF - The heart of Windows setup, calls several of the INF files listed here
TXTSETUP.SIF - Installs all of the Operating System files (do NOT go haywire, commenting everything out!)
WAB50.INF - Windows Address Book
WINNT.SIF - Unattended setup information file
WSH.INF - Windows Scripting Host

Now, look at the contents of my files. (My files end mostly end in underscores. They are mostly uncompressed. Leave them however you see them, the compressed ones aren't interesting. Just double-click on them, and when Windows asks what application to use to view the files, select Notepad.) You will note that I reorganize the contents of INF files and trim out what's not necessary.
Note my IE.INF, which deletes unnecessary IE registry keys, creates "trick" keys for some IE-dependant programs, and copies some files.

Modify the files to your liking, or use my files, or leave the files as they are. Again, in case you missed it above, remember that if you use my files, you don't have to edit anything at all -- these notes are just for tutorial purposes.

Some programs think they need IE. Quickbooks, most Norton software, Adobe Acrobat 8, and PCAnywhere are some examples. Their setup routines check for the presence of the Microsoft HTML engine. To make PCAnywhere work with my fileset, you will have to slipstream IE6 (I know, I told you not to) then edit TXTSETUP and LAYOUT to uncomment CSCDLL.DLL and CSCUI.DLL.

Notes about specific files:

LAYOUT.INF copies files from CD to HDD to a temp dir ; TXTSETUP.SIF copies them from HDD to their final places at installation. Some software like nLite makes edits only to TXTSETUP, because folks won't listen to the whole "delete the _X" thing I pointed out earlier, which means that Windows spends extra time copying files during setup that it won't even use. Which I think is kind of silly, but that's just me.

Commenting out individual files will keep them from being installed. However. If an INF file that is installed calls a file not in LAYOUT, the file will still be installed. In other words, if PROGRAM.EXE is not in LAYOUT, but PROGRAM.INF is in LAYOUT and this INF would install the PROGRAM.EXE file, the file will still be installed.

It's commented out in my SYSSETUP.INF, but if you wanted to add it back, just uncomment it, and it will install.

Licensing issues forced MS to remove this from Windows. The only way you could have it under normal circumstances is if you have an original Windows 2000 install and added Service Packs to it and never did a clean, slipstreamed install (MS has changed service packs so that Microsoft's Java no longer installs). If you installed from a slipstream, ANY slipstream and not just HFSLIP, you don't have MS Java . I know, I know, some of you are convinced that you do. I can't change your mind or convince you otherwise so I won't spend any more time on this. Download the Java Virtual Machine instead. And NO, I'm not linking to the updated MS one that I created!

We will be changing this file so that you do not have to continually retrieve your installation key from your Official Microsoft Product License Repository. Opening your safe where you keep your Official Microsoft Product License every time you reinstall can be a pain.

Remove the word "HIDE" (and DO NOT TOUCH any of the commas) from the old base components. You can put MODES=0 (instead of 0,1,2,3) in their INFs to avoid an installation, or just comment the lines out. You can comment out AU.INF so that it doesn't install (remember, it totally relies on IE anyway). Even if you comment out some entries, you will see that when you install, many of the old base components install anyway. This is because they are called from SYSSETUP.INF.

When installing, you'll have a .BAT program to make COM available in Add/Remove Windows Components. COM is roughly 18Mb. To date, I have found very few programs that rely on it (a few shareware utilities). The OS is a bit of a different story, however. Windows Management seems to need it, and to do certain administrative things, you need WMI. I will say this, however: without COM, I can still do major things like add or remove users, etc.

This is the heart of Windows 2000's setup. It is digitally signed, and just changing it would result in Windows' refusing to install. That's why we hex edit the .DLL files above. Editing this file alone WILL NOT solve the age-old dilemma of removing IE and other components. It helps a lot, but this one file is NOT the key to everything.

What does this file install? Let's have a look:
; You could install IE, if you wanted
; Internet Connection Wizard
; Active Movie for IE
; Web Based Enterprise Management
; Task Manager - opens Port 135, is it really worth it?
; Outlook Express
; Windows Address Book
; Troubleshooter
; Removable Storage Manager requires COM
; Netmeeting
; Harmless
; Remote Storage Recall Notification
; defaults for Image Color Management 2.0
; Application Compatability - trust me, you don't need it
; junk
; MS Data Access Components
; MS Info
; defragger
; media player's codecs
; do not comment out
; portable audio devices that existed in the year 2000

Having a hacked SYSSETUP.DLL file allows us to comment out every INF we don't want to install. But I like emptying out INF files instead... it lets me see very quickly what I am working on. It gets the same thing done either way. Either comment out the INF file entry here in SYSSETUP.INF, or leave it in here but empty out the target INF file. Although I do comment out a few INF files, I simply chose to leave most of them in the SYSSETUP.INF file, allowing me to add custom content to Windows by adding it to these INF files if I want to.

My settings in this file have notes to turn off IPSEC, DHCP, NetBIOS over TCP/IP, and WINS Client (TCP/IP). Mr. LL points out that "DNS resolution does not work under dialup when the DHCP (not DNS!) client service is set to Manual, and for some idiotic reason W2K does not resolve domain names if the DHCP client is stopped. The DHCP client starts the NetBT driver, and the NetBT driver opens port 445." He notes that you have to set the registry accordingly: System\CurrentControlSet\Services\NetBT\Parameters\SMBDeviceEnabled:dword=0. With my files, the infamous ports 135 and 445 will be closed. 137 and 139, however, will be open if you choose to use NetBIOS over TCP/IP. If you really want them closed on a networked machine, you could choose to run your LAN with IPX/SPX instead. HAHA! I made a joke. Read about closing ports on Windows 2000.

Comment out everything under all of the other bracketed sections, or change associations so that they all open with notepad. This dangerous INF registers potentially dangerous scripts that so many Outlook worms and logic bombs seem to make use of. On the other hand, you'd need it for Windows Help. By the way, would you be surprised to discover that having Windows Scripting installed opens Port 135? ...and keeps it open? In my opinion, it's not worth it.

Step 16

Modifying INF files

Installing optional components at Windows installation time, instead of (un)installing them after Windows has been installed, is a very attractive possibility to consider. This step is just to illustrate that "optionalizing" Windows 2000 components at installation time like NT 4 used to allow has been not only been thought of, it has now been tried and found not to work. Perhaps hacking yet another DLL would allow this to work?

I extracted SYSSETUP.DLL from Windows NT 4 and from Windows 2000 and compared them in Resource Hacker.

Let's look at the optional components dialog box in NT 4:

Now, let's check the Windows 2000 version of the same file
to see if any such dialog box exists:

[2004 versions of these files]

So, the Windows 2000 setup process could theoretically be set up to have optional components. This code exists in the Windows XP version of this file also.

In 2011 I discovered, 10 years too late, how to do this. My fileset offers it. You have to remove from reg entries from one of the HIVE files. Windows sees a reg entry and suppresses this dialog. When I posted about how to do this in several forums it was met with yawns. Understandable.

Unhiding the optional components window here, really won't do us any good, because of [Infs.Always] (see below).

Now, check out this section from the Windows NT 4 SYSSETUP.INF file:


; Infs that get run at optional components time,
; in initial and upgrade cases.

Check out the Windows 2000 SYSSETUP.INF file's section:

(Etc., etc...)
(Etc., etc...)

There IS NO [BaseWinOptionsINFs] section in the Windows 2000 SYSSETUP.INF file.

I edited several INF files to have an optional components section (see below), and moved their entries from the [Infs.Always] section to a NEW [BaseWinOptionsINFs] section that I created above the "Always" section. To "optionalize" something, you need to comment the corresponding line out from SYSSETUP.INF, remove any files within TXTSETUP.INF and SYSSETUP.INF that are part of the INF*, and add a line calling the INF to SYSOC.INF. For example, let's take Internet Connection Wizard.

* TXTSETUP.INF copies files from the temporary install directories during setup to their final destinations. Obviously, if we want to make something optional, we have to prevent TXTSETUP from going ahead and installing its files.

You would "optionalize it" by adding something that looks like the following to ICWNT5.INF. Lines in red show lines that were not changed. Lines in blue indicate lines that were added or changed. You'll see, for example, that Internet Connection Wizard is now going to install in it's own directory, not a subdirectory of IE.

; Internet Connection Wizard install script WinNT

signature="$WINDOWS NT$"

; Anything not installed by the system by default
Base.AppDir.CopyFile = 16422,%ICW_DIR%
<-- note IE path edited out
Base.AppDir.DelFiles = 16422,%OLD_ICWDIR%
Base.AppDir.30DelFiles = 16422,%ICW_DIR% <-- note IE path edited out
Base.AppIcon.DelIcon = 10,%ICW_DESKTOP%
Base.SysDir.CopyFiles = 11
Base.HelpDir.CopyFiles = 18

[Optional Components]

OptionDesc = %ICW_DIR%
IconIndex = *

DelFiles=Base.AppIcon.DelIcon, Base.AppDir.DelFiles, Base.AppDir.30DelFiles
ProfileItems=ICW2.StartMenu.DelIcon, ICW3.StartMenu.DelIcon.1, ICW3.StartMenu.DelIcon.2, ICW4.StartMenu.DelIcon, CreateICW

Uninstall = DefaultUninstall
Modes = 0,1,2,3

The rest of the INF proceeds pretty much as usual. See GAMES.INF for an excellent example of how optional components work. The last step, after editing ; icwnt5.inf,DefaultInstall from SYSSETUP.INF and the associated ICW files from TXTSETUP, is to add the INF to SYSOC.INF, like so (old lines in red, new lines in blue):

(Etc., etc., etc., etc...)

ICWNT5=ocgen.dll,OcEntry,ICWNT5.INF,,7 <--- ICW has been added to SYSOC.INF

Again, I want to emphasize that this trick does not present you with an options box during setup, unfortunately. I put it here so that readers know it's been tried. No, that Commandow program doesn't present the box at setup time, either.

If you were not slipstreaming -- in other words, not using HFSLIP at all, you would simply move every single file (the .in_ files, the modified .dll files, and their unmodified backups) right into i386, and when the file move dialogue box asks if you want to replace the files in i386, you would select yes.

Step 17

There is still garbage in the OS!!

Let's have a look inside two of the system's DLL files with Resource Hacker.

SHELL32.DLL (click to enlarge)

SHDOCVW.DLL (click to enlarge)

It's no wonder some shell folders get re-created no matter what we do.

There are A LOT of system files with REGINST sections like these, and the REGINST sections of some of these DLLs will undo what you do to the INF files, no matter what. Fortunately, these sections CAN be edited with Resource Hacker (use semicolons right on top of the "H" in HKEY), and the PE header can be fixed afterward with MODIFYPE.EXE.

By the way, it used to be that SHDOCLC.DLL was the one DLL that would allow you to type an URL into an Explorer window and see a website. This is no longer the case with IE 6 SP1 and higher versions. Micrsoft is consolidating browser functionality into fewer files, like BROWSEUI.DLL, and SHDOCVW.DLL.

Does that mean that their obsolete DLLs they no longer use don't get installed? HAHAHA! Um, NO.

The pictures also happen to illustrate a fatal problem of IE: no other browser allows interaction between the local and other zones. IE does, and it took Microsoft from 2001 to 2005 to address the problems that result from objects being browsed on the Internet crossing into and having an effect on the local system's files.

Trivia: did you know that people who (incorrectly) think that they are safe leaving IE on a system but "not using it" don't know how Zones work, and more importantly, have never read any of the documentation that comes with hotfixes? If your IT people think it's okay to leave IE on a system as long as it's not used, they should probably be fired.

For a particularly amusing case, have a look at the "Firefox lies" site. I don't agree or disagree about Firefox, but the misinformation he spreads about IE has made him a laughingstock. IT'S RIGHT IN THE HOTFIX KB DOCUMENTATION, DUDE!

To truly murder IE, you will need to make changes to the REGINST sections of the following files:

The changes you need to make are all in the REGINST sections. Make the changes with a program like Resource Hacker and "fix" the file afterward by correcting it's checksum with modifype filename -c (remember, that's case sensitive). The sad truth is that any time a hotfix is issued, you would need to re-edit the DLL file before installing it.

Do not make edits to any LocalZone data. If you did, you would be unable to copy or move files! Without IE, there is no way for the Local and Internet Zones to communicate anyway.

Personally, I don't bother with most of these edits (I do a few) because no other browsers make use of the Zones, either LocalZone or InternetZone, so...

without Internet Explorer, not a single MS-HTML based zone exploit can work.

I don't know how much simpler I can make it than that.

IE can allow malware to travel between zones, and if you eliminate IE, you eliminate this back door.

You also need to delete a LOT of IE registry keys, and this is done for you automatically in my version of IE.INF. Have a look in this file and you'll see what I mean. Keep in mind that there are also subkeys that are deleted that do not need to be listed in the INF, and you can imagine the memory savings. Windows 2000 loads the Registry into memory (XP and 2003 do not, they work a little differently).


Technical discussion of driver integration

Before I get into this, have you ever noticed that on each download page at, it says "These so called 'DriverPacks' are built to work with Microsoft Windows 2000...." Yep, you can manually integrate any driver. I just use UNIATA because it's close to a one size fits all solution. Some have their systems lock up with it, however!

To see quickly get a general overview of how to do this, open my TXTSETUP.SIF file and search for the word "UNIATA". This gives you a quick overview of how this process works.

If you have a multi-file driver that you want to integrate and have installed when Windows searches and installs devices for the first time
This is first because it's actually the easiest to do. In this example, your driver's INF file will be called DRIVER.INF.

DRIVER.INF= 1,,,,,,,20,0,0 (directory 20 is the INF folder)
DRIVER.SYS = 1,,,,,,,4,1,0 (directory 4 is the DRIVERS folder)
DRIVER.DLL = 1,,,,,,,2,1,0 (directory 2 is the SYSTEM32 directory)
DRIVER.CPL = 1,,,,,,,2,1,0 (and the ,1, means 'copy the file and disregard upgradability status -- in other words, copy no matter what)

If you have a multi-file driver that you want to integrate and have installed at boot time
It can be done, but it's more detail than I'm going to get into. Look at the [files.vga] section in TXTSETUP.SIF. Follow the process by using the technique below and use the files.vga example to install the extra files.

If you have a single-file driver that you want to integrate and have installed at boot time
This is a popular one for getting Windows to see SATA drives / controllers at boot time. In reality, a SATA driver INF file would probably be named TxtSetup.oem, but in this example, your driver's INF file will be called DRIVER.INF, and the single-file driver will be called DRIVER.SYS.

"mySATAdevice" = PCI\VEN_1791&DEV_0907
"mySATAdevice" = PCI\VEN_1791&DEV_0908
"mySATAdevice" = PCI\VEN_1791&DEV_0909
"mySATAdevice" = PCI\VEN_09b9&DEV_9712
"mySATAdevice" = PCI\VEN_09b9&DEV_9713

PCI\VEN_1791&DEV_0907 = "mySATAdevice"
PCI\VEN_1791&DEV_0908 = "mySATAdevice"
PCI\VEN_1791&DEV_0909 = "mySATAdevice"
PCI\VEN_09b9&DEV_9712 = "mySATAdevice"
PCI\VEN_09b9&DEV_9713 = "mySATAdevice"

driver.sys = 1,,,,,,,4,1,0

mySATAdevice = driver.sys,4

driver.sys = 16

mySATAdevice = "My SATA Driver for Windows 2000"





IE removal process by Fred Vorck. HFSLIP created by TommyP and maintained by TommyP and Tomcat76.

This is the fourteenth revision of a process I originally created in 2001. I just want the information available. Information just tends to dissipate, like heat. A wakeup call to people who create novel procedures to accomplish these conveniences like removing IE from Windows and then restrict the information: people resent you for it. You figure the rest out.

Copyright issues. The purpose of this explanation, and information about reverse engineering. Although Microsoft retains Copyright, when we edit INF files, we make use of a portion of Windows files under the doctrine of Fair Use.

This procedure is to enhance your understanding of Windows 2000. If you carry it out it ends Microsoft's technical support obligations to you and you'll probably violate their contract by adhesion (EULA). Also, don't think for one second that you could do this and complain if something goes wrong. We're only trying to speed your system up and maybe teach you some things.