0x0000026F Illegal DLL Relocation Fix – 3 Causes That Work

Cause #1: Malware or rogue software hooks the DLL

I've seen this more times than I can count. Some piece of junk software—often a freeware tool or a sketchy driver updater—loads a system DLL like user32.dll or kernel32.dll and tries to hook into it. Windows doesn't allow that to happen at the normal load address, so it relocates the DLL. The system throws 0x0000026F because it can't trust the relocated version.

Last year I had a client who installed a “PC optimizer” from a pop-up ad. Next boot, his accounting software wouldn't launch. Event Viewer showed that exact error on ntdll.dll. After I cleaned the malware out, the error vanished.

How to fix it

1. Run a full scan with Windows Defender Offline or Malwarebytes. Don't just use the built-in quick scan—boot into safe mode and do a full scan.
2. Check for recently installed software. Go to Settings > Apps > Installed apps and sort by installation date. Uninstall anything you don't explicitly trust.
3. Use sfc /scannow in an admin command prompt to restore any corrupted system files.

sfc /scannow

If that finds issues but can't fix them, run DISM /Online /Cleanup-Image /RestoreHealth next.

Cause #2: A broken software installer or update

Sometimes the error pops up right after you install or update a program. The installer tried to overwrite a system DLL or inject a new version into the same load space. Windows grabs the original DLL and puts it somewhere else, then throws the error.

I'm looking at you, older versions of Adobe Reader and Java 8—they've both triggered this on Windows 10 22H2 machines. Also, some printer drivers from 2018-era HP printers do the same thing.

How to fix it

1. Identify the offending software. Check Event Viewer under Windows Logs > Application. Look for the error with source “Application Error” and Event ID 1000. The faulting module name will show which DLL got relocated.
2. Uninstall the program that caused it. Go to Settings > Apps > Installed apps, find it, and uninstall.
3. Reinstall the latest version of that software from the official site. If it's an old version you need, try running it in compatibility mode for Windows 7 or 8.

Pro tip: If you can't uninstall normally, use Revo Uninstaller Free to zap every leftover file and registry entry. I've had to do that twice this year alone.

Cause #3: DEP (Data Execution Prevention) or UEFI Secure Boot settings

Less common, but I've seen it on custom-built gaming PCs and some Lenovo ThinkPads. DEP is set too aggressive and blocks the DLL from loading at its intended address. Or Secure Boot is enabled, and the relocated DLL doesn't have a valid signature for that address.

One customer brought in a laptop that had Secure Boot turned on but also had an unsigned driver for a security camera. Every time Windows tried to load that driver's DLL, it got relocated and errored out.

How to fix it

1. Check DEP settings: Open System Properties (sysdm.cpl), go to Advanced > Performance > Data Execution Prevention. Make sure it's set to “Turn on DEP for essential Windows programs and services only”. If it's on “all programs”, that's almost certainly the issue.
2. If you need DEP on all programs, add the specific program's exe to the exception list in the same panel.
3. For Secure Boot problems: Go into UEFI/BIOS settings (usually press F2 or Del at boot), find Secure Boot, and set it to Disabled. Only do this if you're sure the software is legit—otherwise leave it on and update the driver.

bcdedit /set nx AlwaysOff

That command disables DEP entirely—use it only as a last resort for testing. Reboot after.

Quick-reference summary table

Try them in that order. Nine times out of ten, the malware fix gets it done. If not, the broken installer is the next suspect. The DEP/Secure Boot thing is rare, but don't ignore it if the first two fail.