I'd never trust any illegal download site for an OS.
I'd tell him to bite the bullet and go to Newegg and get a OEM copy of XP home sp3, it's $89.00. You can often find it on Ebay from a decent seller for a little less. Or, try PC Linux, or some Windows similar distro if you think he can handle it.

i have the product key, just not the disk. and i wouldnt want to give him an illegal os.
i gave him a copy of unbuntu linux (what i had on hand) and told him to try it out as a live cd and see if he would make the switch, but he may have to buy a new one.

thanks for the help guys!

The license to the OS is restricted to the computer it was sold with. The service pack version has nothing to do with it. You can take a computer (Dell for example) that came with Windows XP Pro and install from a Windows XP Pro SP2 CD without a problem. There is no violation of anything nor is it illegal.

@JonMCC33: That is true though there are a couple conditions on that:
1. The Windows XP Pro disc you install needs to match the install disc. Weather it's retail, oem or volume.
2. Some service packs include a new product key validation routine when the all the product keys on the last version have all been used up. For example there could be a Windows XP SP2 specific product key and using a Windows XP SP1 disc wouldn't work with that key. I think the topic op may have an issue similar to this.