Illegal System DLL Relocation?
When I intend to manually load the user32.dll into memory, after loading the sections and calling its DllMain, an error message appears that the system dll was relocated in memory.
If I load it at its preferred ImageBase and thus do not do relocation, this error occurs. However, if I load it into a system choosed address (pass NULL to VirtualAlloc), no error occurs. I can confirm that the loading position of the sections of user32.dll are as correct as the specification tells. Could anyone tell me why?
Sincerely thanks!
Ответы
- sounds to me that some other DLL in your process is already in memory at the perferred base address of user32.dll. Check carefully with dependency walker which addresses all the DLLs of the process have (preferred base) and are actually used (actual base - you need to use the "profile" feature of dependency walker)
Все ответы
- sounds to me that some other DLL in your process is already in memory at the perferred base address of user32.dll. Check carefully with dependency walker which addresses all the DLLs of the process have (preferred base) and are actually used (actual base - you need to use the "profile" feature of dependency walker)
The Dependency Walker is helpful, though my problem is still not resolved.
Actually, my intention is to manually load an EXE into a host process, the PELoader, and its dependent modules, the dlls, and finally execute it. The current problem is that, when calling the entry point of some dll, it will throw exception, usually accessing invalid memory address.
The PELoader originally only need KERNEL32.dll and the dependent NTDLL.dll. However, when I try to call the DllMain() of the dlls, in Dependency Walker, I can see other denpendent dlls are correctly imported and called. I think this implies that this way of using dll is somewhat also available.
I do not know if anyone here has relative experience of this field. If someone could give me any advice, I will be grateful!
- right hello evry one when i downloaded the windows update 'security update for windows' it restarted my system wen downloaded now it comes up with this error name 'system DLL relocation' i need some help to get rid of this any one who can help i would be highly greatfull
- Thank God I am not alone! I got exactly the same message after downloading windows update and restating my computer. I've got no clue of what is going on.
- Omg, seriously. I, too, installed today's security update only to see this message pop up. What's going on?
- OMFG. I just installed the most recent Windows update today, as well! I looked at the date of the original poster and figured that this was a dated forum, but then I looked at the last three posted dated today.
Yes, just a moment ago, I installed MS's latest security update and I'm getting the same message at bootup:
The system dll user32.dll was relocated in memory. The application will not run properly. Yada, Yada.
Of course, with all MS messages, it basically shucks responsibility to third parties by instructing me to contact the "vendor supplying the DLL should be contacted for a new DLL."
Typical MS response.
Anyway, I'm gonna go back to a restore point just before the update. I'm sure if this propagates, ZDNet or someplace like that will have news on another MS Security Update that MS dropped the ball on. Oh good so i'm not the only one, hope that someone finds an answer soon cos it's doing my nut!
Already tried a system restore & it didn't work.
- hy please help lol, rite i downloaded the latest update and also gt the same message and also when i tryed a system restore it came back incomplete. what can i do. i dont actually no much about pc's
- System restore doesn't appear to work. Anyone know how we get a proper answer on this thing? Anyone found a link yet?
- Okay, folks, I'm back after doing a "system restore" to the point prior to installing the security update today. I'm not getting the message anymore.
I'm thinking, tell me if I'm wrong, that the following security fix that was released today:
Microsoft Security Bulletin MS07-017
Vulnerabilities in GDI Could Allow Remote Code Execution (925902)
http://www.microsoft.com/technet/security/Bulletin/MS07-017.mspx
...is the culprit. And, I think, there may have been two releases today. Not sure. Regardless, going back to a restore point just before I installed the update helped me avoid the message. I hope all of you have automatic restore points created on a regular basis.
Restore points can be found at:
Start Button / Help and Support / Pick a Task... then choose "Undo changes to your computer with System Restore"
Let us know if it works for you. If so, let's get the word out, people!
P.S.
I just noticed that System Restore is not working for some. It worked for me, but I make regular restore points at EVERY change. I went back to the point BEFORE the update I made with MS's Security Update. Not AT that point.
However, I understand that, for some, a restore may not work. I had actually uninstalled a piece of software after the update, then had to reuninstall it after the restore to help fix some ancillary issues that arose out of today's security update.
Nonetheless, MS should come up with a fix. They must. It appears to be propagating, and no one should rely on a restore point for a fix. But truly, doesn't MS ever beta test these things anymore? Slackers! - No, system restore failed. Had a restore point on 31st March. Doesn't say why it failed, it just states that it couldn't be used.
- Found something.
Check this out http://support.microsoft.com/?kbid=925902 - Great job, Matt! Looks like that issue definitely pertains to me. I'll look further into it and, if I feel comfortable with the solution, will reinstall the update with the hotfix following. Thx, Matt!
- Don't know you on earth to contact for the hotfix tho!
- How do we get the hotfix? Do we really have to phone up for it or put up with the annoying error message every time we boot up?
- U think you've got it bad. I'm in the UK and it's 10.30 PM here. Nobody home at MS UK!
- I just had a look through the support pages and it is a minefield in there. Whoever gets the file first pop it on FTP somewhere
- hya so i dont quite understand what to do is it best to ring ms tommorow cuz im not very computer literate pls write back
- You're not kidding Matt, it's their fault but we've got to ring between 8am-6pm monday to friday...some of us work for a living!!!
- Anyone tried doing an add/remove of the update via the windows manager?
- did the update today - same problem happened.
of course system restore is turned off.
if anyone downloaded the hotfix, upload it to www.jumbodir.com pls or yousendit. K thanks
btw. i have an asus p5w dh deluxe board with the realtek HD audio card - As far as I can tell nothing seems to be broken except for an annoying error message when I reboot...would be good to fix tho
- I'm a programmer but not a Windows techie type person but I would agree it looks like everything is working. All the same, I won't be happy till it's fixed. Anyone had any luck getting the hotfix?
- well, for me everything else is working fine except i cannot access my realtek hd audio cards mixer
we need the 935448 hotfix, right? - Going to add/remove and removing the update KB925902 seems to have got rid of the annoying message but I guess is not the real solution.
- Looks like MS have finally given the link to the hotfix on theKB page....
http://support.microsoft.com/kb/935448/ - http://www.microsoft.com/downloads/details.aspx?familyid=74AD4188-3131-429C-8FCB-F7B3B0FD3D86&displaylang=en
- has it worked?
Thanks to Matt, again, for alerting me to the article number. Now, in my case with the aforementioned article number, contacting Microsoft Support and applying the HotFix worked for my system. I reinstalled the MS security updated, which then recreated the error message, applied the hotfix while on the phone with Microsoft (no charge, btw), and voila, no more error message.
What's important to note is the unforeseen problem that could occur with this specific issue (providing your error message is identical to the one noted on Article #935448). The user32.dll being relocated to memory could promote further unstable problems. Without the user32.dll, the operating system becomes unusable (or unbootable), from what I understand.
Check out the following for information regarding this issue, the one specific to me, in hopes that we are all experiencing the same issue:
General Link: http://support.microsoft.com/?kbid=925902
RealTek Specific Link: http://support.microsoft.com/default.aspx/kb/935448/
The two links above are basically the same with more specific info on the latter.
Okay, I just wrote that contacting support was the only way to obtain the fix. But apparently, enough people were having an issue that the fix is now downloadable from here:
Make certain your problem is identical to what is outlined above. Good luck everyone!
- thankyou matt berry ure the man should that have resolved the system restore issue uswell pls rite back as im tired lol
- Yes, it seems to be working just fine now. Realtek control panel is back, no error message on reboot.
Thanks Houston, we made it
I'm going to bed,
Dom The download you requested is unavailable. If you continue to see this message when trying to access this download, go to the "Search for a Download" area on the Download Center home page.
can anyone upload the .exe who has it to http://www.jumbodir.com or somewhere else? cheers!
And a final note from me. Everything seems back to normal.
I would just like to thank Microsoft for wasting two hours of my life on this which meant I missed tonight's Life On Mars on the BBC. UK people will understand.....!
Thanx everyone for the info and links to the download. Everything's fine on my machine after download got posted
Bryan
ok if the MS link is down or isn't working for someone, try this: http://www.jumbodir.com/get/?id=c083e626-707b-f59c-c641-3857ce22679a
it has worked for me as well, nicely, without any reboot needed.
- It's worked for me too. Thanks guys and good night!
Chris, make sure you reboot anyway. This way, you know for sure the fix has taken and that the error message is gone. Just to be on the safe side.
Link again for the specific fix:
- WAY TO GO MATT. followed your link to fix the problem""Illegal System DLL Relocation", downloaded the hotfix, restarted my pc(held my breath) and the irritating ERROR BOX WAS GONE. Thnx!!!
- I did the system restore also which did not fix the problem till I found this forum. I downloaded the hotfix and did not do the update again should I have done the update first then did the hotfix? One other question when I downloaded the hotfix why is it now on my desktop and when I right click to open it wants to know if I want to run this file do I run or what I am not to smart with computers obivously as you all can tell I just need some help with this any would be nice I sure would appreciate it alot thanks.
- after today window update, i got this illegal system dll relocation error that says user32.dll was relocated in memory....shell32.dll and the vendor should provide new DLL sth....how to solve this problem? cuz my com seems to hang v often after i got this error message. Anyone can help? thanks in advance.
anyone else having an issue with there tv tuner after installing the update and thx for the fix people.
i have installed the fix and that stopped the Illigeal system dll relocation thing but it hasnt done anything to fix my tv tuner.
here are my system specs for reference
this is also a media center pc came pre installed with ms mce 2005Manufacturer: HP Pavilion 061Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+, MMX, 3DNow (2 CPUs), ~2.6GHzMemory: 2046MB RAMHard Drive: 620 GB TotalVideo Card: Radeon X1600 SeriesMonitor: gateway 19 inch wide screen flat panelSound Card: Realtek HD Audio rear outputSpeakers/Headphones: logitech x850 surround soundKeyboard: Enhanced Mulmedia PS/2 KeyboardMouse: Logitech HID-compliant G5 Laser MouseMouse Surface: slickOperating System: Windows XP Professional (5.1, Build 2600) Service Pack 2 (2600.xpsp_sp2_gdr.050- Just spent about 1.5 hours on the phone with support. Go to http://snipurl.com/1f21w and download a hotfix called 935448 "security update" save the file to the desktop, then run it to install it, and last restart. This will get rid of the error box when your computer reboots!
YES! This kb download has solved the exact problem described!
Matt:
Thanks for finding the link to fix the "illegal system DLL relocation" error. This problem, following the installation of the MS07-017 XP Security Update issued on 4/3/07 affects the startup of the Realtek HD Audio Control Panel (Rthdcpl.exe).
The Link provided by Matt (http://support.microsoft.com/?kbid=925902) takes you to the hotfix page (http://support.microsoft.com/default.aspx/kb/935448/). The hotfix can be downloaded from the "Resolution" section of the page. The hotfix apparently replaces the HHCTRL.OCX file.
I ran the hotfix and after my system rebooted it had resolved the error. Thanks again for your help.
Mike
- Dear Spanish speaking friends - Amigos de habla española:
Just had the same problem - Acabo de tener el mismo problema.
Got it solved by downloading the hotfix in spanish - Se resolvió descargando el archivo en español.
Best regards - Muchos saludos,
Sir Joe SORRY GUYS BUT THIS DIDNT MADE MY ERROR GO AWAY WHAT SHOULD I DO?
MY CALCULATOR STILL DOES NOT WORK AND THE ERROR COMES OUT ALL THE TIME
Thanks a lot. After restore everything is back to normal
PCheers,
Magda
- Thank you Matt. I too spent a couple of hours searching for anything and everything relating to the error message. I was lucky to finally come upon a forum post with those glorious words - "think I found something". If you happen to be in the Los Angeles area, I owe you a drink for being so kind and sharing your findings with everyone.
- IF RESTORE DOES NOT WORK :
I suggest doing the following, either going to your Add/Remove programs and REMOVE the update, OR.. download CCleaner (*** Cleaner) and remove the update that way using Uninstall.
Either way, it works fine for me whereas the Hotfix did nothing at all. Thank you, Matt! The problem has been solved.
I've rebooted several times, and no error message. One has just to follow up what one is being told in that page.
Matt,
Thank you for the info. Sure wish Microsoft would take the extra effort to ensure things work right before they cause all these problems.
- Great work, Matt! Thanks! That seems to have solved it for me!
I'm not sure why it wasn't included in the update to avoid all of us spending an hour, but it seems to be working now.
Thanks! - hi Matt,
This link was gr8, it did help me get that error removed!!! Thanks
Others can go ahead and get it done
Rgds
Brad - Thanks Matt...this kb took me to the exact hofix I needed which resolved my problem.
Thanks Matt Berry. Yesterday I allowed an automatic security update from microsoft to install and when I rebooted the first time (and every time since) got a popup on my desktop re:Realtec audio and user32.dll just as your link describes.
Your link has a "package" to download. I'll try it I guess. Thanks again.
- A friend was having the same issues and I was browsing online to try and find some help and came across a fix on Microsofts page with a link to resolve the issue. On this page http://support.microsoft.com/kb/935448/ scroll down to under 'RESOLUTION' and you will see the link.
Same here - the error stays, the calc does not work....
Any idea?
- If you do not have service pack 2 installed, the fix will not work - there is however a link under resolutions on http://support.microsoft.com/kb/935448/ to fix that also
I started to get the same error message after updating the Windows XP. The said error message also instructs us to contact the vendor supplier, that is to say the mighty Microsoft, to get the updated System DLL. If you want to get this support from MS you have to pay them via your credit card. Nice American thing.
Microsoft is hosting this site so why the guys at its headquarters did not do anything so far.
Act NOW!
Many thanks for all this info (and thanks to Google for indexing it fast so I could find it!)
Two of our Dell PCs had this user32.dll relocated error this morning; removing the overnight security update eliminated the error but now I know I might also need to install the patch file.
Thanks, Mike. it worked very nicely. I have no startup problem now.
I actually do not use the Realtek audio (to which the error is related) but I use SoundBlaster X-Fi audio. Do I have to uninstall the Realtek audio? I am not can anybody help me?
Thanks.
Rogers
- Thanks so much! I woke up to the same message on my "farily" new laptop...all computer problems cause me major stress. I tried restoring to yesterday but this failed, then I kept working my way back until a point last week worked, and I'm no longer getting the message. I've also changed my Windows Updates setting to prompt me instead of automatic. Thanks again.
- After few more hours I'm finally back to working PC without start-up errors and working calc :-)
Here is the workaround:
I use FlyakiteOSX v3.5 - a software that changes the GUI of a Windows PC machine to OSX GUI. Until yesterday everything was fine - I use this program for years. Today, after installing the Windows update I was asked to restart the PC. After the restart - the calc.exe does not work and starts with the known to all of us error.
I installed the Realtek fix without to solve the problem. Also un-installed both (the update and the fix) - did not solved the problem.
Thinking of what more can be done, I started the FlyakiteOSX v3.5 install file - there is a option for un-install and choosed to un-install the "OSX-ed" (about 25 MB) shell32.dll and to return the original file (8.06 MB). This solved the problem - after restart NO errors and working calc.
I restarted again the FlyakiteOSX v3.5 install file and choosed to install again the "OSX-ed" shell32.dll but with only 48x48 pixels. After restart everything works fine!
Bottom line - if the fix does not help, try to restore the original shell32.dll. Maybe this will solve you the problem. Worked for me :-)
Cheers!
(now I need a beer... or two..) Hey y'all - had the same error message, thanks SOOO much for the link to the download/patch. When I restarted my computer I did not get the error message (was I supposed to if the patch hadn't worked?)
One question: How do I verify that my RealTek Audio stuff works? I've read some people talking about the RealTek Audio 'panel' - where can I find this panel and verify it works again? Thanks so much in advance!
Thank you very much for posting this.
I am running Windows XP SP2 and Realtek would not open due to the latest Windows updates I downloaded. After running this patch I am not getting the error message on boot up.
try this link to download a fix, I had the same problem, wanted to post this before I restarted
http://www.microsoft.com/downloads/details.aspx?familyid=74AD4188-3131-429C-8FCB-F7B3B0FD3D86&displaylang=en- Why can't this hotfix be bundled into the update. This is huge. All HP business desktops have come with RealTek cards for years.
- Just had to say thanks to Matt and Mike, the microsoft support page and hotfix page you gave out fixed the problem. Good to see people not blinding us with techcy nonsense.
- Matt, you're awesome. Thank you!!!
Microsoft said to me that they are looking at reissuing the update but that they need to build a business case.
Support for Microsoft Security Updates is free. Can I please urge you all to phone Microsoft and log an incident if you've had a problem?
i have a similar proplem dont know how to resolve none of the patch or update is working for me
---------------------------
RTHDCPL.EXE - Illegal System DLL Relocation
---------------------------
The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occurred because the DLL C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
---------------------------
OK
---------------------------i know how about no more updates unless it wont make your mum have a go at you for breaking the computer
fixed now but thanx microsoft for winding up my mum lol
- hi, i have had the same problem, an finially fixed it 2day, download this http://www.microsoft.com/downloads/details.aspx?familyid=74AD4188-3131-429C-8FCB-F7B3B0FD3D86&displaylang=en it shud fix your problem.
- Thank you all so much for posting and helping.... this support website was indeed the fix. I too downloaded the security update yesterday morning... and next boot up I got that message... so I went to this link installed an poof....the error is gone thank goodness...
- Thanks, I repaired my PC with the fix about an hour ago.
Matt Berry wrote: Found something.
Check this out http://support.microsoft.com/?kbid=925902
wow, it's totally work for me. Thank Matt!!!!Thanks Mike,
Directions worked perfectly. No more error pop-ups.
John
- I have the same but no idea how to clear it !
- The patch did not work for me as the error seems to apply to ghostscript as well as realtek (which I don't have). Any word on a new patch or help ?
- Great job Matt, that fix worked great. I didn't try a system restore I just went to the address you provided and downloaded the fix and, wham, I back up and running.
Hi I had the same problem..
935448 package from Microsoft . I found the answer after I searched the web. Put 935448 in the search at
Microsoft home page and it will take you to it. I downloaded it and restarted and the error was gone.
Dave
- Yes you have to download 935448 package from Microsoft.
- Thank you sooooo much , I thought it was something I had done ,really appreciate the link. Cheers fron New Zealand
- Thank you for the info - fixed my problems. Took me longer to figure out how to register here - than to run the patch LOL
Rogers wrote: Thanks, Mike. it worked very nicely. I have no startup problem now.
I actually do not use the Realtek audio (to which the error is related) but I use SoundBlaster X-Fi audio. Do I have to uninstall the Realtek audio? I am not can anybody help me?
Thanks.
Rogers
- Thx Matt. Solution worked for me.
- After installingthis update my calculator doesn't work and I get the error message.
Does anybody know how to fix this issue orpoint me in the right direction ?
many thanks
Roberto I had the same problem, probably from the same download/update. The patch I found at http://support.microsoft.com/?kbid=925902 corrected my problem. Thanks alot. Hi Guys,
I had the same problem and got really annoyed with the meassage appearing every time switcehd on my laptop but now the problem solved!
Go to http://support.microsoft.com/kb/935448/en-us and under the resolution title click on Download the 935448 package now
After downloading it restart your computer.
The mesage will be gone forever!!!
Wish you all stress free days!
- hello from Spain
Hotfix in Spanish does not work in Windows XP Media Center Edition 2005, says that language of hotfix (selected in Spanish) is incorrect - Thanks Matt--it worked. The hotfix is the download. MS had to help us and this is it.
Just wanted to say it's wonderful you found this link, I just stumbled across this problem with my computer, started googling to see if there was a fix, found this message, and the new download fixed it! Thanks!
Good Job guys!
I had no idea what all this was about... thought it had to do with some setting I changed in my system recently. The hot fix resolved that irritating start up message.
thanks a lot again and keep up the good work
Anil
- I turn on my computer May 5 and it boots up, but S-L-O-W-L-Y. I get the error message everybody on this thread is describing and realize it's the KB925902 update. After fishing around I load the hotfix found below:
http://support.microsoft.com/kb/935448/
When I load, it the error message goes away. Great. But my computer is still SLOW.
I turn off my security updates, do a defrag and a system restore, which speeds my computer back up to where it was.
I'd like to keep getting updated but I can't live with what KB925902 and 935448 do.
Is anybody else having THIS problem? Steps to Uninstall Windows-XP Security Update (KB925902)
1. Open Control Panel
2. Click on Add or Remove Programs
3. Locate above security update under Windows-XP Software Updates
4. Reinstall Security Update for Windows-XP (KB925902)
5. Reboot and "RTHDCPL.EXE- Illegal System DLL Relocation" error message will cease.
- I am having this issue with avgcc.exe. my AVG wont work! i have tried the hotfix multiple times. system restore doesnt even resolve the issue.
- i just used my norton go back and i'm up and running again. microsoft should be ashamed of themselves for this. it's more than 24 hours since this download, and still no response from them how to make this right if you don't have norton go back. why can't they un-install a corrupt program as easily as they install one? shameful!
Gee... I tought my kids down loaded some nasty bot.... It' s only MS screwing up( no worries, we all messup), and not telling us about it ( a VERY NASTY HABIT for these guys - unforgivable, I'd say ) - anyhow.. I'm broke too and restore doesn't restore.. I was about to call HP....but it's MS after all.... dang...this is sick. So,.... when's the fix................?
Wild willy
- Matt, Thanks for the great info. I went to microsoft and downloaed the update for windows xp . ( KB935448 ) I installed this and rebooted and everything is back to nomal. Thanks again Mike
- I haven't tried removing the security fix, but I get the relocation problem with AVG's free anti-virus software (which no longer works) and GarageGames Constructor (http://www.garagegames.com/mg/snapshot/view.php?qid=1436). This didn't work for me:
http://support.microsoft.com/default.aspx/kb/935448/en-us - Hi, I'm having the same but sorta different problem. On my PC the only program that does not work is Nero. It says C:\Windows\system32\SHELL32.dll occupied an address range reserved for Windows systems DLLs.
So how do I fix the probllem when it's the SHELL32? I already tried reinstalling it but no luck, I don't even know what I did wrong.
Please help.
Thanks
Anon. - I'm having the same problem with nero and calc etc. The hotfix does nothing.
- Had same problem, testing now.
- Thanks Matt I had resolved myself to just uninstalling the problem update, and not re downloading it again, on reading about the hotfix I thought I'd give it a try, I re downloaded the update, the error message appeared as expected, then I went straight to the link and downloaded the hotfix, ran it, restarted my system and hey!!!!!!!! the problem has all gone, Matt, you're a star!! Thank you!
Working with Calc and OpenOffice quickstarter. Same illegal system DLL relocation. None of the hotfixes have worked, and I've checked the OpenOffice website for any news. Any further insights into this one?
- Same problems (calc & OOo). Also can't update my JRE (shouldn't have uninstalled before reading this forum. stupid...). Would love to get some idea that isn't reloading XP. Thanks for everyone's help up unitl now.
- Thank you Matt for the website. I tried looking for it but to no avail. The website you gave went straight to it and fixed my problem. Thanks again.
I am the owner of a small Internet Service Provider and since that last Security update I have had no fewer than 10 different customers call my support line with the same error. Also, my own machine is affected by this. Ever person I have talked to has stated it occurred immediately after the security update. I have also noted some randomness as to which DLL is being flagged in the error message. My original one involved the windows help system, not my system is reporting an error with a DLL involving the sound system.
Has anyone heard of a resolution of this?
I was having the same problem that it seems everyone else here is talking about and system restore didn't work for me either.
Your information helped me fix the problem. I am now sending it to a friend. Thank You.
- After I installed the hotfix, my problem still exists. In fact, when I am trying to open the calculator....this error message pops up:-The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occurred because the DLL C:\WINDOWS\system32\SHELL32.dll occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.Any ideas? Thanks!
- Same over here when I try to use the calculator.........
- it appears that microsoft has made a fix..
I believe to manually fix, you just replace the file that is said to occupy the memory location. I'm trying this now.
A custom them (like bricopaks) replaces the original shell32.dll. So if thats the file, your solution is to get rid of your custom theme. Worked for me.
- for those who have FlyakiteOSX v3.5, you don't need to uninstall the program, just reduce the icon size to 48*48 pixels
that will reduce the SHELL32.DLL and the problem disapear... - just wanted to let you know I was having the same problem, I was trying to install a Wacom Tablet driver and was getting the error.
uninstalled the windows update 925902 and the problem was fixed.
good luck everyone.
