Illegal System DLL Relocation after Windows Update

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 04/04/2007
Time: 07:27:56
User: N/A
Computer: xxx
Description:
Application popup: RTHDCPL.EXE - Illegal System DLL Relocation : The system
DLL user32.dll was relocated in memory. The application will not run
properly. The relocation occurred because the DLL
C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for Windows
system DLLs. The vendor supplying the DLL should be contacted for a new DLL.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Vulnerabilities in GDI Could Allow Remote Code Execution (925902)
http://www.microsoft.com/technet/sec.../ms07-017.mspx

http://support.microsoft.com/kb/925902
Known issues
After you install this security update on a Windows XP Service Pack 2
(SP2)-based computer, Realtek HD Audio Control Panel (Rthdcpl.exe) may not
start. Additionally, you receive an error message that is similar to the
following:
Rthdcpl.exe - Illegal System DLL Relocation
The system DLL user32.dll was relocated in memory. The application will not
run properly. The relocation occurred because the DLL
C:\Windows\System32\Hhctrl.ocx occupied an address range reserved for Windows
system DLLs. The vendor supplying the DLL should be contacted for a new DLL.

Update for Windows XP (KB935448)
Install this update to resolve an issue where the Realtek HD Audio Control
Panel may not start after you install security update KB925902 (MS07-017) and
security update KB928843 (MS07-008)
http://www.microsoft.com/downloads/d...displaylang=en
Supported Operating Systems: Windows XP Service Pack 2


"Nitish" wrote:

> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 04/04/2007
> Time: 07:27:56
> User: N/A
> Computer: xxx
> Description:
> Application popup: RTHDCPL.EXE - Illegal System DLL Relocation : The system
> DLL user32.dll was relocated in memory. The application will not run
> properly. The relocation occurred because the DLL
> C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for Windows
> system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>

There is a post at GRC.com newsgroup that installing the new R1.64 version
High Definition Audio Codecs from
Realtek should fix the problem. No need for the hotfix as per the poster at
GRC.com.
You may also use the hotfix provided by Microsoft if you prefer to not to
upgrade to version R1.64.



"Nitish" <> wrote in message
news:739AA180-B765-4373-9E40-...
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 04/04/2007
> Time: 07:27:56
> User: N/A
> Computer: xxx
> Description:
> Application popup: RTHDCPL.EXE - Illegal System DLL Relocation : The
> system
> DLL user32.dll was relocated in memory. The application will not run
> properly. The relocation occurred because the DLL
> C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for
> Windows
> system DLLs. The vendor supplying the DLL should be contacted for a new
> DLL.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>

hi what do i need to do help

"Nitish" wrote:

> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 04/04/2007
> Time: 07:27:56
> User: N/A
> Computer: xxx
> Description:
> Application popup: RTHDCPL.EXE - Illegal System DLL Relocation : The system
> DLL user32.dll was relocated in memory. The application will not run
> properly. The relocation occurred because the DLL
> C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for Windows
> system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>

http://support.microsoft.com/default.aspx/kb/935448/

download patch, it worked for me.

"cmeden" wrote:

> hi what do i need to do help
>
> "Nitish" wrote:
>
> > Event Type: Information
> > Event Source: Application Popup
> > Event Category: None
> > Event ID: 26
> > Date: 04/04/2007
> > Time: 07:27:56
> > User: N/A
> > Computer: xxx
> > Description:
> > Application popup: RTHDCPL.EXE - Illegal System DLL Relocation : The system
> > DLL user32.dll was relocated in memory. The application will not run
> > properly. The relocation occurred because the DLL
> > C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for Windows
> > system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >

Hi,

Indeed, the hotfix corrects the initial RTHDCPL.exe relocation failure.

Unfortunately, this isn't the one that was showing first when I rebooted my
computer.

The message I got is the following :

---------------------------
Language.exe - Illegal System DLL Relocation
---------------------------
The system DLL user32.dll was relocated in memory.
The application will not run properly.
The relocation occurred because the DLL C:\WINDOWS\system32\SHELL32.dll
occupied an address range reserved for Windows system DLLs.
The vendor supplying the DLL should be contacted for a new DLL.
---------------------------
OK
---------------------------

The above occured after installing the Security Update for Windows XP
(KB925902)

Size: 455 KB - 1.7 MB

A security issue has been identified that could allow an attacker to
compromise your Windows-based system and gain control over it.
You can help protect your computer by installing this update from Microsoft.
After you install this item, you may have to restart your computer.

More information for this update can be found at
http://go.microsoft.com/fwlink/?LinkId=84687

)) The "Illegal System DLL Relocation" situation has also been reported for
the "Realtek HD Audio Control Panel" (RTHDCPL.exe)

A suggested fix, WindowsXP-KB935448-x86-ENU.exe, has been applied and
resolved the "Realtek HD Audio Control Panel" DLL relocation issue.

However, the "Language.exe" DLL Relocation issue still apply after the
KB935448 hotfix.

To temporarely prevent this "Illegal System DLL Relocation" issue, a
rollback of the KB935448 hotfix and the KB925902 Security Update have been
performed.

Any suggestion to prevent that DLL Relocation ? Any "real" hotfix that will
prevent that from happening, instead of a one hotfix per application approach
?

Last, but not the least. When I see that Windows XP has been around for
over 6 years and there are still bugs of that nature, what would convice to
spend the money and get Vista ?

I'm running Win XP Home with SP2.

Thanks.

Daniel.
---------------------------------------

"TaurArian" wrote:

> Vulnerabilities in GDI Could Allow Remote Code Execution (925902)
> http://www.microsoft.com/technet/sec.../ms07-017.mspx
>
> http://support.microsoft.com/kb/925902
> Known issues
> After you install this security update on a Windows XP Service Pack 2
> (SP2)-based computer, Realtek HD Audio Control Panel (Rthdcpl.exe) may not
> start. Additionally, you receive an error message that is similar to the
> following:
> Rthdcpl.exe - Illegal System DLL Relocation
> The system DLL user32.dll was relocated in memory. The application will not
> run properly. The relocation occurred because the DLL
> C:\Windows\System32\Hhctrl.ocx occupied an address range reserved for Windows
> system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
>
> Update for Windows XP (KB935448)
> Install this update to resolve an issue where the Realtek HD Audio Control
> Panel may not start after you install security update KB925902 (MS07-017) and
> security update KB928843 (MS07-008).
> http://www.microsoft.com/downloads/d...displaylang=en
> Supported Operating Systems: Windows XP Service Pack 2
>
>
> "Nitish" wrote:
>
> > Event Type: Information
> > Event Source: Application Popup
> > Event Category: None
> > Event ID: 26
> > Date: 04/04/2007
> > Time: 07:27:56
> > User: N/A
> > Computer: xxx
> > Description:
> > Application popup: RTHDCPL.EXE - Illegal System DLL Relocation : The system
> > DLL user32.dll was relocated in memory. The application will not run
> > properly. The relocation occurred because the DLL
> > C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for Windows
> > system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >

"Daniel B." <Daniel B.@discussions.microsoft.com> schrieb:

> ---------------------------
> Language.exe - Illegal System DLL Relocation
> ---------------------------
> The system DLL user32.dll was relocated in memory.
> The application will not run properly.
> The relocation occurred because the DLL C:\WINDOWS\system32\SHELL32.dll

Are you using any third party themes ("Transition Packs" etc.) and the
like on/for your system?

Could you verify the vendor and source of the "language.exe" on
your system? I don't want to threaten you, but it _might_ be malware:
http://www.auditmypc.com/process/language.asp

Bye,
Freudi

Thanks Freudi for your reply.

As far as I can see, the language file being invoked at the system startup
is indeed legitimate. It is part of the Cyberlink PowerDVD package. I'd be
very doubtful that this program would be a threat.

On the other hand, with all the respect you deserve, when I'm being provided
with links to sites that have no other goals than presenting products, such
as the way too invasive NAV for instance, I'm on my guards by nature.

I'm not putting down the info you gave me, however this will provide me with
a starting point and see if the same issue has been reported elsewhere.

Meantime I hope someone using the PowerDVD program will stop by and indicate
if he/she is facing a similar situation to mine.

Btw, I'm using the Vista Inspirate scheme, but I didn't experience any issue
so far with it in regards to the system stability. If there is any report or
indication that this product could jeopardise the system environment, I don't
mind uninstalling it, as long as I have a good reason to believe this is the
thing that is actually causing me griefs.

Best regards.

"Ottmar Freudenberger" wrote:

> "Daniel B." <Daniel B.@discussions.microsoft.com> schrieb:
>
> > ---------------------------
> > Language.exe - Illegal System DLL Relocation
> > ---------------------------
> > The system DLL user32.dll was relocated in memory.
> > The application will not run properly.
> > The relocation occurred because the DLL C:\WINDOWS\system32\SHELL32.dll
>
> Are you using any third party themes ("Transition Packs" etc.) and the
> like on/for your system?
>
> Could you verify the vendor and source of the "language.exe" on
> your system? I don't want to threaten you, but it _might_ be malware:
> http://www.auditmypc.com/process/language.asp
>
> Bye,
> Freudi
>

"Daniel B." <> schrieb:

> Btw, I'm using the Vista Inspirate scheme, but I didn't experience any issue
> so far with it in regards to the system stability. If there is any report or
> indication that this product could jeopardise the system environment, I don't
> mind uninstalling it, as long as I have a good reason to believe this is the
> thing that is actually causing me griefs.

Uninstall that scheme, theme, pack please. There have been some
reports now, that uninstalling those design changeing applications
resolves error messages mentioning system32.dll with KB925902
installed.

Bye,
Freudi

Ok I updated my computer to fix this problem but now have 3 new errors that
appear when I turn my computer on saying:

MemCheck.exe - Common Language Runtime Debugging Service

And Process id 0xf94 3988

....three times with different numbers

Does anyone know how I can sort this out please?


"Nitish" wrote:

> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 04/04/2007
> Time: 07:27:56
> User: N/A
> Computer: xxx
> Description:
> Application popup: RTHDCPL.EXE - Illegal System DLL Relocation : The system
> DLL user32.dll was relocated in memory. The application will not run
> properly. The relocation occurred because the DLL
> C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for Windows
> system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>