HHCTRL recurring alert in Windows Application Log
I have been using Spybot1.62 for some time and have just upgraded it to Spybot 2.2.21.0 (free version to try it out)
Following the upgrade my application log (on two machines where it is installed) has started to have entries relating to HHCTRL :-
The description for Event ID 1903 from source HHCTRL cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
http://go.microsoft.com/fwlink?LinkID=45839
This occurs every 5 minutes.
After a lot of searching I found a scheduled task for Spybot updates which runs every 5 minutes. Disabling this task stops the application log entries from occurring. Both machines are Windows 7.
According to the Microsoft site this error relates to a vulnerability that was fixed in Windows XP.
I have no experience of this new version - is this something that is expected to happen or is there an issue?
Thank you,
Arthur.
P.S. I run Microsoft Security Essentials, Malwarebytes and Spybot and none of them are reporting any vulnerabilities.
EventID 1903 HHCTRL Windows 7 Professionalk 32-bit
I have the same problem on my Windows 7 Professional 32-bit system. As a test, I went to services.msc, and I stopped the Spybot S&D 2 Updating Service. The Application EventLog 1903 entries continued, even after I had stopped the service. I did not reboot after stopping the service. I checked the started task log (Schtasks /Query /FO /List /V), and the 1903 EventLog entries occur one second after the Updating Service task runs. This leads me to believe that it is this task that is producing the HHCTRL entries.
There are two questions that arise:
1) Why are the EventLog entries being generated? Is the HHCTRL part of HTML Help? I am not sure. If so, what is Spybot doing that causes this entry to be generated?
2) The EventLog says, "The description for Event ID 1903 from source HHCTRL cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer." I have seen this with MANY EventLog entries, and it implies that the application in question, in this case Spybot, has not installed a piece that the EventLog viewer needs to decode the entry. I do not know the internals of the EventLog system, so I have no idea exactly what additional piece is needed in the Spybot distribution and installation.
Some previous poster complained that these entries are too numerous, and they may obscure entries that point to real errors. I do not rely on the EventLog in Windows the same way I relied on the system logs on the IBM mainframe or Unix systems on which I was an administrator. The reason is that many of the entries have no useful information, as I noted above.
--Barry Finkel
I Still Do Not Understand What Is Happining
I am replying because 1) I was part of this thread three years ago, and 2) I am still getting the EventLog entries.
I do not understand what is happening. Before I run a Spybot scan, I always do an update. And that process tells me that I have not updated in x days (if I have skipped one or more days since the last update). So, Spybot is not automatically updating on my system. So, why is an update process checking every 10 minutes? And why is that update process producing the EventID 1903 message? I normally do not look at the EventLog, because it is filled with items such as these, which say, if I interpret them correctly, "some process wrote an EventLog entry, but the installation of that software did not include any 'template' for interpreting that EventLog entry". These EventLog entries are meaningless to me, and I would prefer that they not be in the EventLog. I would not mind the Spybot update process running every 10 minutes, doing something, and then logging the fact.
What exactly is the Spybot update process doing? And can Spybot install the missing "template" so that these Eventog entries contain meaningful information? Maybe someone can give me more info as to what is happening. I did not really understand the last reply from two years ago. Thanks.