Jumat, 15 Januari 2010 di 10.09 |  
bbrapa cara untuk mngatasi error yg muncul sperti

Illegal System DLL Relocation

The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occured because the DLL C:\WINDOWS\system32\SHELL32.dll occupied and address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.


1.Menimpa dengan mngcopy file shell32.dll dari komputer lain, file ini terletak pada C:\WINDOWS\system32\ (OS komputer harus sama,. misalx komp1 dan komp2 menggunakan windows XP SP2)
hal ini disebabkan rusakx file trsebut yg disebabkan oleh false alarm atau cleaning system.

2.Menscan dengan menggunakan antiSpyware terbaru.(coba dengan Ansav, gunakan plugin RegistryFx) hal ini biasax disebabkan karena komputer pernah terserang trojan.

ciri2x: beberapa file instalasi tidak dapat djalankan dikarenakan hook yg tidak valid.

coba repair registry dengan mnyalin kode dibawah ke dalam notepad,.

[Version]
Signature="$Windows NT$"
Provider=WardanaPro

[DefaultInstall]
AddReg=Write
DelReg=Delete

[Write]
HKCR, .bat,,,"batfile"
HKCR, .cmd,,,"cmdfile"
HKCR, .js,,,"jsfile"
HKCR, .vbs,,,"VBSfile"
HKCR, .reg,,,"regfile"
HKCR, .exe,,,"exefile"
HKCR, .scr,,,"scrfile"
HKCR, .com,,,"comfile"
HKCR, .pif,,,"piffile"

HKCR, batfile\shell\open\command,,,"""%1"" %*"
HKCR, cmdfile\shell\open\command,,,"""%1"" %*"
HKCR, JSFile\shell\open\command,,,"%SystemRoot%\System32\WScript.exe ""%1"" %*"
HKCR, VBSFile\Shell\open\command,,,"%SystemRoot%\System32\WScript.exe ""%1"" %*"
HKCR, regfile\shell\open\command,,,"regedit.exe "%1""
HKCR, exefile\shell\open\command,,,"""%1"" %*"
HKCR, comfile\shell\open\command,,,"""%1"" %*"
HKCR, piffile\shell\open\command,,,"""%1"" %*"

HKCR, batFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, cmdFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, JSFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, VBSFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, regFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"

HKCR, batfile\DefaultIcon,,,"%SystemRoot%\System32\shell32.dll,-153"
HKCR, cmdfile\DefaultIcon,,,"%SystemRoot%\System32\shell32.dll,-153"
HKCR, JSFile\DefaultIcon,,,"%SystemRoot%\System32\WScript.exe,3"
HKCR, VBSfile\DefaultIcon,,,"%SystemRoot%\System32\WScript.exe,2"
HKCR, exefile\DefaultIcon,,,"%1"
HKCR, comfile\DefaultIcon,,,"%SystemRoot%\System32\shell32.dll,2"

HKCR, batfile, FriendlyTypeName,0, "MS-DOS Batch File"
HKCR, cmdfile, FriendlyTypeName,0, "Windows NT Command Script"
HKCR, JSFile, FriendlyTypeName,0, "@%SystemRoot%\System32\wshext.dll,-4804"
HKCR, VBSFile, FriendlyTypeName,0, "@%SystemRoot%\System32\wshext.dll,-4802"
HKCR, ScrFile, FriendlyTypeName,0, "Screen Saver"
HKCR, comfile, FriendlyTypeName,0, "MS-DOS Application"
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden,0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, "Explorer.exe"
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Userinit,0, "@%SystemRoot%\system32\userinit.exe"
HKLM, SYSTEM\CurrentControlSet\Control\Session Manager, BootExecute,0, "autocheck autochk *"
HKLM, SYSTEM\CurrentControlSet\Control\Session Manager\Environment, ComSpec,0, "%SystemRoot%\system32\cmd.exe"
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\CurrentControlSet\Services\PugPlay, ImagePath,0, "%SystemRoot%\system32\services.exe"
HKLM, SYSTEM\CurrentControlSet\Services\srservice, ImagePath,0, "%SystemRoot%\system32\svchost.exe -k netsvcs"
HKLM, SYSTEM\CurrentControlSet\Services\MSIServer, ImagePath,0, "%SystemRoot%\system32\msiexec.exe /V"
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, "cmd.exe"

HKLM, Software\Microsoft\Windows\CurrentVersion\Policies\System, legalnoticetext,0, ""
HKLM, Software\Microsoft\Windows\CurrentVersion\Policies\System, legalnoticecaption,0, ""


[Delete]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFind
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoRun
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDesktop
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFileAssociate
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFolderoptions
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFileMenu
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDrives
HKCU, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoTrayContextMenu
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableCMD
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system, DisableTaskmgr
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system, NoFolderoptions
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoTrayContextMenu
HKLM, Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp, Disabled

HKCR, batfile, NeverShowExt
HKCR, cmdfile, NeverShowExt
HKCR, VBSFile, NeverShowExt
HKCR, JSFile, NeverShowExt
HKCR, exefile, NeverShowExt
HKCR, comfile, NeverShowExt
HKCR, pifile, NeverShowExt
HKCR, scrfile, NeverShowExt

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskMgr.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskkill.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskList.exe


simpan dengan nama apa saja tp berekstensikan *.inf

klik kanan dan pilih instal

jika masih belum selesai, mngkin cara lain yang dapat dilakukan yaitu dengan mengupgrade service Pack windows. misalx anda menggunakan Service Pack 2, maka anda dapat mngupgrade menjadi Service Pack 3.
Diposting oleh * Label: , ,

0 komentar:


Chat Widget
Visit the Site
...........::::::::Wellcome DI BLOG-X =#=#= Gwe Meonkzt =#=#= | Enjoy it:::::::::...........