Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemswindowsxp-kb958687-x86-enu.exe is Microsoft’s English-language, 32-bit (x86) installer for the Windows XP security update KB958687, also known as security bulletin MS09-001. The January 2009 update replaces vulnerable Server Message Block (SMB) components. It is intended for supported Windows XP Service Pack 2 (SP2) and Service Pack 3 (SP3) x86 installations—not for modern Windows and not for Windows XP Professional x64.
The file can be legitimate when obtained from the Microsoft Update Catalog or an official Microsoft archive. A filename alone cannot authenticate a copy from an unknown mirror. Verify its Microsoft digital signature before running it, use the correct architecture and service pack, and plan for a restart: Microsoft requires a reboot to complete this update.
As an Amazon Associate I earn from qualifying purchases.
What the filename means
The name is descriptive:
- windowsxp identifies the operating-system family.
- kb958687 is Microsoft’s Knowledge Base update number.
- x86 means 32-bit Intel-compatible Windows, not 64-bit Windows XP.
- enu indicates the English-language package.
- .exe is a self-extracting Windows update installer.
Microsoft’s MS09-001 bulletin says KB958687 resolves two privately reported vulnerabilities and one publicly disclosed vulnerability in the Server Message Block (SMB) protocol. SMB handles network file and printer sharing, so the patch updates system networking files rather than installing a general-purpose application.
What files it changes
Microsoft Support lists the patched Srv.sys file as version 5.1.2600.3491 for Windows XP SP2 and 5.1.2600.5725 for Windows XP SP3. Both entries carry an 11 December 2008 UTC file date. The Microsoft Update Catalog record describes a 642 KB Security Update for Windows XP, dated 13 January 2009.
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
Which computers can use it?
| Computer or package | Use windowsxp-kb958687-x86-enu.exe? |
Reason |
|---|---|---|
| Windows XP SP2, 32-bit, English | Yes | This is the intended x86 package. |
| Windows XP SP3, 32-bit, English | Yes | This is the intended x86 package. |
| Windows XP Professional x64 | No | XP x64 requires a separate x64 package and filename. |
| Windows Vista, 7, 8, 10, 11 or later | No | Those systems use different update packages. |
| Non-English Windows XP | Not necessarily | The enu suffix identifies the English package; obtain the language-specific release where applicable. |
To check the service pack and architecture before installation, right-click My Computer, choose Properties, and read the Windows edition, service-pack level and whether the installation is 32-bit or 64-bit. You can also open winver from Start > Run to confirm the Windows XP version. If the machine is XP Professional x64, stop and locate the x64 KB958687 package instead of forcing this executable.
Is windowsxp-kb958687-x86-enu.exe safe?
When the package is trustworthy
The KB number and filename match Microsoft’s security bulletin and catalog entry. A copy downloaded directly from the Microsoft Update Catalog or an official Microsoft archive is the appropriate provenance. Microsoft’s January 2009 Security Release ISO also lists KB958687 among its included updates; that explains why the installer may appear on older administrator media.
Why a filename is not proof
Anyone can rename a different program to look like a Microsoft update. A copy from a random download site, file-sharing service or unsolicited attachment should be treated as untrusted even when its name is exact. Do not disable security software to make an installer run, and do not execute a package whose signature check fails.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to check the Microsoft signature
- Right-click the executable and choose Properties.
- Open the Digital Signatures tab. A genuine Microsoft-signed package should show a signature from Microsoft.
- Select the signature, choose Details, and confirm that Windows reports the signature as valid.
- If the tab is missing, the signature is invalid, or Windows cannot establish trust, delete the file and obtain a fresh copy from an official Microsoft source.
Signature validation authenticates the signed file; it does not mean the old operating system is secure today. Windows XP is end-of-life, and installing this 2009 patch does not provide current security support or protect against later vulnerabilities.
Before you install KB958687
- Confirm 32-bit Windows XP SP2 or SP3 and the English-language requirement.
- Use a package from the Microsoft Update Catalog or an official Microsoft archive, not an unknown mirror.
- Close applications and save work. The update requires a restart.
- Make sure you can sign in with an account that can install system updates.
- If the computer is business-critical, make a backup or a restorable system image before changing system files.
These checks prevent the most common “not for this computer” result: the wrong architecture, an unsupported service-pack level, a mismatched language package or a package intended for another Windows release.
How to install the update manually
Interactive installation (recommended for troubleshooting)
- Obtain the verified x86 English package and place it in a local folder such as
C:Downloads. - Double-click
windowsxp-kb958687-x86-enu.exe. Running it interactively lets you read the exact error text if setup stops. - Accept the update terms and allow the installer to replace the SMB files.
- When prompted, restart Windows. Microsoft states that a restart is required to finish KB958687.
- After Windows starts, open Add or Remove Programs in Control Panel and enable Show updates. Look for the Windows XP security update identified as KB958687.
Unattended installation
Microsoft documents two switches for controlled deployments:
| Command | Effect | Use it when |
|---|---|---|
windowsxp-kb958687-x86-enu.exe /quiet |
Suppresses status and error messages. | A deployment system is handling the update and logging. |
windowsxp-kb958687-x86-enu.exe /quiet /norestart |
Suppresses messages and prevents an automatic restart. | You have a planned maintenance reboot; restart manually afterward. |
Open Start > Run, type cmd, change to the folder containing the file, and run the command. Do not use /quiet as a first troubleshooting attempt: hidden messages make it harder to identify a wrong-package or prerequisite problem. If you use /norestart, restart as soon as the maintenance window permits; the update is not complete until Windows has rebooted.
How to remove KB958687
Control Panel method
- Open Control Panel and select Add or Remove Programs.
- Check Show updates.
- Select the Windows XP update for KB958687 and choose Remove.
- Follow the prompts and restart if Windows requests it.
Spuninst utility
Microsoft also places an uninstall program in the update’s hidden backup directory. Open Start > Run and enter:
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
%Windir%$NTUninstallKB958687$SpuninstSpuninst.exe
Use this route only when the Control Panel entry is unavailable. Removing a security update restores the earlier SMB files, so do it only to resolve a confirmed compatibility problem and preferably after recording the installation error.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Fixing “not for this computer” and other installation errors
1. Recheck architecture and service pack
Read System Properties again. This executable is x86 only. XP Professional x64 cannot use it, even though both systems are called Windows XP. SP2 and SP3 have different patched Srv.sys versions, but both 32-bit editions use the x86 package identified by this filename. If the dialog says the update does not apply, do not repeatedly launch the same file; obtain the package that matches the installation.
2. Replace an untrusted or damaged download
Compare the file you have with a fresh copy from the Microsoft Update Catalog or an official archive. A partial download, altered mirror copy or invalid signature can make setup fail before it examines Windows. Delete the suspect file rather than trying to repair it.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Restart pending Windows
A previous update may have left a restart pending. Reboot normally, sign in, and run the installer interactively again. If you used /quiet /norestart during deployment, perform the planned restart before judging whether KB958687 installed.
4. Run interactively and capture the exact message
Double-click the package instead of using /quiet. Write down the complete error text, the Windows edition, SP2 or SP3 status, and whether the system is x86 or x64. Those details distinguish an applicability problem from a damaged package or a setup failure.
5. Check whether it is already installed
In Add or Remove Programs, enable Show updates and search for KB958687. If it is listed, a second installation attempt is unnecessary. If the catalog package reports that the update is already present, verify the installed entry and the system’s restart status before taking further action.
6. Preserve setup information
For a failure that remains after the checks above, save the exact error code and any setup log created by the installer, along with the service-pack and architecture details. Microsoft does not publish one universal remedy for every KB958687 installer error; the error text and log are needed to choose the next step. Avoid downloading replacement system files from unofficial sites or manually overwriting Srv.sys.
Architecture, source and installation choices
| Decision | Safer choice | Why |
|---|---|---|
| Architecture | Match x86 to 32-bit XP; use the separate x64 package for XP Professional x64. | Packages contain different binaries and applicability rules. |
| Service pack | Confirm SP2 or SP3 before running setup. | The patched Srv.sys version differs by service pack. |
| Download provenance | Microsoft Update Catalog or an official Microsoft archive. | A filename cannot establish that an unknown mirror copy is genuine. |
| Installation mode | Interactive first; /quiet only for controlled deployment. |
Interactive setup exposes useful error text. |
| Restart policy | Restart when prompted, or immediately after a deliberate /norestart deployment. |
Microsoft requires a reboot to complete the update. |
What this update does not do
- It is not a standalone SMB application or a modern Windows installer.
- It does not upgrade Windows XP to a supported operating system.
- It does not provide security fixes released after January 2009.
- It does not make an x64 XP installation compatible with an x86 package.
- It does not prove that every file with this name is safe; provenance and signature still matter.
If the computer must remain in service for legacy software, isolate it from untrusted networks where practical, restrict file-sharing exposure, keep verified backups, and plan migration to a supported Windows release. Those measures address the broader risk that a historical patch cannot solve.
Quick Recap
For related system-file, crash or slowdown troubleshooting on a supported Windows 11, 10, 8 or 7 installation, Outbyte PC Repair is an optional shortcut that can address more than 100 common Windows issues where possible, including broken system elements, invalid redirects and shared DLL files; it also offers cleanup, settings tweaks, vulnerability checks and an app-crash log. It complements an antivirus rather than replacing one, results vary, and no tool repairs every crash. A free trial lasts at least two days before a paid subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
