Hotfix for User32.dll error caused by April 3 Windows Update
Original posting date: 04/03/2007 - Updated on 04/19/2007
If you installed the KB925902 Windows Update patch, released on April 3, 2007, and rebooted to see the following error message, I have solutions for you.
Rthdcpl.exe (or other file) - Illegal System DLL Relocation
"The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occurred because the DLL C:\Windows\System32\Hhctrl.ocx occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL."
This problem occurs when the Realtek HD Audio Control Panel (Rthdcpl.exe) by Realtek Semiconductor Corporation, or AVG 7.5, or certain other applications are installed, which use Hhctrl.ocx. The name of the file causing the conflict will be related to the application it belongs to. The Hhctrl.ocx file that is included in security update 928843 and the User32.dll file that is included in security update 925902 have conflicting base addresses. This problem occurs if a program loads the Hhctrl.ocx file before the program loads the User32.dll file. A list of the applications known to be affected are in my extended comments.
If this happened to your Windows computer, please read this Microsoft Knowledge Base article:
935448 Certain programs may not start, and you receive an error message on a computer that is running Windows XP Service Pack 2: "Illegal System DLL Relocation"
You can read the details about the cause of the problem and download a Hotfix from that page which addresses the issue with the Realtek and other listed device drivers and applications. Alternately, install update 935448 by using Automatic Updates or by using Microsoft Update. To use Microsoft Update, visit the following Microsoft Web site: http://update.microsoft.com/microsoftupdate
Or, better yet, go directly to the manufacturer - Realtek drivers download page and download the newest audio driver (Realtek has released version 1.64 to address this problem), which corrects the above mentioned problems and also works with Windows Vista operating systems.
If you are using another program that is on the affected list, such as AVG Anti Virus Control Center 7.5, check for updates from the manufacturer, which will correct the underlying problem. Most of these updates may require a reboot to install completely, If no updates are available yet, apply the hotfix listed above (for validated copies of Windows XP SP-2 only).
A list of applications known to be affected is below, in the extended comments...
Microsoft has confirmed that this problem affects the following third-party applications.
Realtek HD Audio Control Panel - v1.41, 1.45, 1.49, 1.57
ElsterFormular - v2006, 2007
TUGZip - v3.4
CD-Tag - v2.27
Suunto Ski Manager - v1.0.2, 1.1, 1.2
AVG Anti-Virus Control Center - v7.5
BMC PATROL - v7.1
BricoPack Vista Inspirat - v1.1
Last updated on 4/19/07. This list will be updated if more affected applications are confirmed.
Spyware Doctor is a multi-award winning spyware removal utility that detects, removes and protects your PC from thousands of potential spyware, adware, Trojans, keyloggers, spybots and tracking threats.
Spyware Doctor is fully capable of detecting and removing hidden processes associated with complex threats and rootkits. Such threats are otherwise difficult to remove by conventional means since they may be hidden to the operating system.
A Startup Scanner removes references to malicious programs that run at startup in the registry and Windows startup files, as well as malicious files in Windows startup locations.
State-of-the-art scanning engines, including file scan, memory scan, registry scan, browser helper objects scan, cookie scan and much more.
