Thousands of Event ID 1903 Source HHCTRL

[Luvsql]

The auto-updates on our Win 2003 server SP 2 is not set to auto-install. This morning I checked the event log and there are thousands of these messages in the app log.

How do we determine which MS security update caused this? I remember seeing this a couple years ago but it's crept back.

 

[itsp1965]

See if this helps

http://eventid.net/display.asp?phase=1&eventid=1903&eventno=5907&source=HHCTRL

 

[Luvsql]

We don't have TightVNC.

 

[itsp1965]

Did you read the beginning of the thread

This problem may appear if you install security update M896358 or security update M890175. See M892675 to resolve this problem.
Click if the comment is good! x 2

 

[Luvsql]

I do not see either of those security updates applied to our server (MS security updates are listed as KB not M and are 7 #s and not 6). I even checked the WindowsUploadLog file and there is no reference to 896358 or 890175.

 

[Luvsql]

I have found the source of the issue. If I clear the log there are none of these messages until a scheduled task is run (runs a bat file to open an appliction to run a job). I cannot disable this job.

Do we just have to live with our app log getting filled up daily? We've been having minor issue with another application that requires me to check the app log, but if it's getting constantly filled up and reset, I can't see any other issues.

This issue is new within the last week.

 

[itsp1965]

I can understand the frustration of perpetually seeing an unwanted alert. If you know what application is being called that is generating these alerts you may want to talk to the application vendor who can provide a registry fix that will stop this type of logging. As as an example, I saw this thread

I got this "event" every time a link was clicked while using an older version of the MSDN Library that I installed on my machine. ALL of the links were locally installed help files too. Adding this registry entry fixed my problem:


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"OverrideLMZLinHHContainer"=dword:00000001

Can not find any documentation on the DWORD entry "OverrideLMZLinHHContainer", so not sure if adding it imposes a security risk or not. Found the value name while doing a text search on the actual hhctrl.ocx file near the documented registry values. Best I can tell it stands for "Override Local Machine Zone Level in HH container". Worked for me. Just sad that Microsoft can't seem to get anything right anymore, and we have to resort to undocumented registry hacks to make things work.

 

[Luvsql]

It's a Microsoft appplication (Dynamics GP) that runs that we've never had an issue with before.

 

[itsp1965]

That may be the case but HHCTRL.OCX was essentially "broken" by a recent update. Not sure if re-registering the OCX file will help you can try the link to the tool listed in the link below

http://www.articlesbase.com/software-articles/how-to-instantly-fix-the-hhctrlocx-error-4257426.html

As this is an MS product, you may need to contact MS support for a hotfix

 

[Luvsql]

I checked the registry and it doesn't have HTMLHelp listed under Software > Microsoft. I tried re-registering the ocx file but that didn't work either. I cleared the app log and as soon as I ran the scheduled task, bam, full log.

The bat file that runs is as follows:

"C:\Program Files\Microsoft Dynamics\GP10\Dynamics.exe" "C:\Program Files\Microsoft Dynamics\GP10\Dynamics.set" "C:\Program Files\Microsoft Dynamics\Integration Manager 10\LogIntoGP.mac"

Funny thing is if I just run the Dynamics.exe to run the program, the log file does not fill up.

 

[Luvsql]

It's been 4 months and this issue is still occuring. I see so many other users with this issue. Why is there not a hotfix to resolve this? I do not have any of the security updates mentioned in any of the TKs. You kinda need the application log to see errors if you run into issues, but if it constantly fills up daily with useless information events, makes it impossible to troubleshoot.