Certain programs may not start, and you receive an error message on a computer that is running Windows XP Service Pack 2: "Illegal System DLL Relocation"

Certain programs may not start after you install security update 925902 (MS07-017) and security update 928843 (MS07-008) on a computer that is running Microsoft Windows XP with Service Pack 2 (SP2). Additionally, you may receive an error message that resembles the following:

You may find it easier to follow the steps if you print this article first.

To resolve this problem, follow these steps:

1. Install all important updates from the following Microsoft Web site:
   http://update.microsoft.com/microsoftupdate

   (http://update.microsoft.com/microsoftupdate)
2. Try to run the program that did not start again. If the program starts and if you do not receive the error message in the "Symptoms of the problem" section, you are finished. If the error continues, follow steps 3 through 5.
3. Visit the following Microsoft Web site:
   http://www.microsoft.com/downloads/details.aspx?familyid=74AD4188-3131-429C-8FCB-F7B3B0FD3D86&displaylang=en

   (http://www.microsoft.com/downloads/details.aspx?familyid=74AD4188-3131-429C-8FCB-F7B3B0FD3D86&displaylang=en)
4. Click Download, and then click Run. If the Download button is not available, you must first click Validate to validate your copy of Windows.
5. Follow the instructions that appear on the screen to install update 935448.

You may receive a similar error message that references Shell32.dll when you run AVG Anti-Virus Control Center from Grisoft, Inc. This problem occurs if you are also running BricoPack Vista Inspirat from CrystalXP. To resolve this problem, uninstall BricoPack Vista Inspirat.

Note This is not a problem with AVG Anti-Virus Control Center or with Windows. This problem is not resolved when you install update 935448.

Cause of the problem

The Hhctrl.ocx file that is included in security update 928843 and the User32.dll file that is included in security update 925902 have conflicting base addresses. This problem occurs if a program loads the Hhctrl.ocx file before the program loads the User32.dll file. Microsoft has confirmed that this problem affects the following third-party applications.Notes

• If you receive a similar message when you use another program, install the update that is mentioned in this article. If we confirm that other programs are affected by this problem, we will update this article with more information.
• This problem does not occur with version 1.64 of the Realtek HD Audio Control Panel.

Update deployment information

To resolve this problem, use one of the following methods, as appropriate for your situation.

Important Windows Update and Microsoft Update only detect the affected versions of Realtek HD Audio Control Panel, ElsterFormular, TUGZip, and CD-Tag. However, other programs are affected by this problem. Therefore, if update 935448 is not installed on the computer by using Method 1 or by using Windows Server Update Services (WSUS) in Method 2, use Method 3.

Method 1: Install update 935448 by using Automatic Updates or by using Microsoft Update

To use Microsoft Update, visit the following Microsoft Web site:

Method 2: Deploy update 935448 in an enterprise by using Windows Server Update Services (WSUS) or Microsoft Systems Management Server (SMS)

IT professionals can use WSUS or SMS to deploy this update in an enterprise. For more information about WSUS or SMS, visit the following Microsoft Web sites:

Method 3: Install update 935448 from the Microsoft Download Center

The following file is available for download from the Microsoft Download Center:

Download the 935448 package now.

Release Date: April 3, 2007

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Known issues

Security update 928843 (MS07-008) and update 935448 contain Hhctrl.ocx files that have the same version number. If you install security update 928843 (MS07-008) after you install update 935448, you must reinstall update 935448.

Prerequisites

To apply this hotfix, you must have Windows XP Service Pack 2 (SP2) installed on the computer.

Installation information

To install this update without requiring any user intervention and without restarting the computer, administrators can use the following command:Note Restart the computer, and then verify that the installation was successful if you use the /quiet or the /restart switches. You should also review the KB935448.log file for information about any errors that occur when you use the /quiet switch. For more information about the setup switches that are supported by this update, click the following article number to view the article in the Microsoft Knowledge Base: Restart information You may have to restart the computer after you apply this update.

File information

The English version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For Service branch SP2GDRFor Service branch SP2QFE

Note When you install this update, the installer checks whether one or more of the files that are being updated on the system have previously been updated by a Microsoft hotfix. If you have previously installed a hotfix to update one of these files, the installer copies the SP2QFE files to your computer. Otherwise, the installer copies the SP2GDR file to your computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Verify that the update is installed

To verify that this update is installed, use the following methods:

• Method 1: Compare the version of the file that is installed on your computer to the version that is documented in the "File information" section.
• Method 2: Verify the files that this update installed by reviewing the following registry subkey:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB935448\Filelist
  Note This registry subkey may not contain a complete list of the installed files. Also, this registry subkey may not be created correctly if an administrator or an OEM integrates or slipstreams the update into the Windows installation source files.

Removal information

To remove this security update, use the Add or Remove Programs item in Control Panel. Administrators can also use the Spuninst.exe utility to remove this security update. The Spuninst.exe utility is located in the following folder: To remove this update without requiring any user intervention and without restarting the computer, administrators can use the following command:

Status of the problem

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References

For more information about security update 925902 (MS07-017) and security update 928843 (MS07-008), click the following article numbers to view the articles in the Microsoft Knowledge Base: For more information about the command-line switches for Windows software update packages, click the following article number to view the article in the Microsoft Knowledge Base: For more information about the terms that are used to describe software updates, click the following article number to view the article in the Microsoft Knowledge Base:The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

The following table lists significant technical revisions to this article. The revision number and the last review date in this article might indicate minor editorial revisions or structural revisions to this article that are not included in the table.