HHCTRL recurring alert in Windows Application Log

[arthur1963]

I have been using Spybot1.62 for some time and have just upgraded it to Spybot 2.2.21.0 (free version to try it out)

Following the upgrade my application log (on two machines where it is installed) has started to have entries relating to HHCTRL :-

The description for Event ID 1903 from source HHCTRL cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

http://go.microsoft.com/fwlink?LinkID=45839

This occurs every 5 minutes.

After a lot of searching I found a scheduled task for Spybot updates which runs every 5 minutes. Disabling this task stops the application log entries from occurring. Both machines are Windows 7.

According to the Microsoft site this error relates to a vulnerability that was fixed in Windows XP.

I have no experience of this new version - is this something that is expected to happen or is there an issue?

Thank you,

Arthur.

P.S. I run Microsoft Security Essentials, Malwarebytes and Spybot and none of them are reporting any vulnerabilities.

[Zenobia]

I have no experience of this new version - is this something that is expected to happen or is there an issue?

I'd never noticed it being posted about here before.
But I was looking at your post and searching for what it might be,and found I have it in my event viewer,too.Who knew?

This is going to be kind of vague,but I haven't quite found exactly what the cause or fix is in an exact way.
But,there are quite a few references to this event being recorded in the event log for some people where it's related to a scheduled task.
2Brightsparks,which from the looks of it is some kind of backup software,has this article up:
http://support.2brightsparks.com/kno...dows-event-log

But, after some exhaustive checks & tests by various users, it appears it is the Scheduler itself (or Windows in general, in response to the Scheduler) logging an error when trying to unload the Windows user-profile used in/by the Scheduled Task from memory.

This is an older post,but there's a person here saying it's recorded in Event Viewer every 30 minutes,which is when their antivirus was scheduled to check for updates:
http://www.techsupportforum.com/foru...xp-475646.html

My event viewer has the event logged under Application,Information,so I don't think it's an over cause for concern.
If I can ever find what exactly causes it,I'll remember to post it here.

[Zenobia]

Changing the Spybot Check for updates task from System to my account,then Run only when user is logged on,and run with highest privileges stopped the Event 1903 from being logged in Event Viewer from 11:04 onwards.
Enabling the Check for updates task history after rebooting shows the task having Action started,Action completed when I logged on,and every 5 minutes thereafter.

Only problem is Spybot's Updates logfile isn't showing the check for updates every five minutes,so I guess that wasn't exactly a roaring success. :/

If you prefer not to have Event 1903 happening and would prefer to leave the Check for updates task disabled,that should prevent it.If you do go with that,you ought to make sure you remember to check for updates manually.
Or,if you prefer to reenable the check for updates,having Event 1903 happen doesn't look like it would cause any harm,so it's up to you.

[arthur1963]

Changing the Spybot Check for updates task from System to my account,then Run only when user is logged on,and run with highest privileges stopped the Event 1903 from being logged in Event Viewer from 11:04 onwards.
Enabling the Check for updates task history after rebooting shows the task having Action started,Action completed when I logged on,and every 5 minutes thereafter.

Only problem is Spybot's Updates logfile isn't showing the check for updates every five minutes,so I guess that wasn't exactly a roaring success. :/

If you prefer not to have Event 1903 happening and would prefer to leave the Check for updates task disabled,that should prevent it.If you do go with that,you ought to make sure you remember to check for updates manually.
Or,if you prefer to reenable the check for updates,having Event 1903 happen doesn't look like it would cause any harm,so it's up to you.

Thank you for the replies.

It is odd that there are other scheduled tasks but only this one seems to create the log entry.

I tried various changes to the task most of which resulted in it failing to run or running and never completing so have just left it disabled for now or may set it to run once a day until I have a chance to dig a bit deeper.

The Spybot's Updates logfile only seemed to record an entry when it actually had anythng to update and not every time so perhaps this is why you didnt see entries in your test?

As you say it doesnt seem to cause any harm but having a log filling up with junk entries makes it difficult to spot genuine issues.


Arthur.

[Zenobia]

You're welcome.

When I was searching for what causes Event 1903,there were a few references to it happening when a scheduled task is set to 'Run whether user is logged on or not',which I noticed the Spybot update task was configured as.I didn't find anything real definite,but it seemed reasonable at the time that it's possible that's part of the cause or the cause of the event.
Though,I do have three other tasks set by other programs to 'Run whether user is logged on or not',but two are set to run with highest privileges.
The third one is set to 'Run whether user is logged on or not' without admin privileges,and the only difference between that and the Spybot update task is that this one is set as hidden.
But,the Event 1903 stopped happening on the 11th when I disabled the Spybot update task.so it's possible that 'Run whether user is logged on or not' isn't part of the cause of the event happening,too.

The Spybot's Updates logfile only seemed to record an entry when it actually had anythng to update and not every time so perhaps this is why you didnt see entries in your test?

Yes,you're right,I didn't notice that.Thanks.

As you say it doesnt seem to cause any harm but having a log filling up with junk entries makes it difficult to spot genuine issues.

I agree.With my own updates task,I decided to disable it,like you did.I plan on going in and re-enabling the task again in a day or so,but changing the update times,probably to once a day.I was thinking that would cut down on so many of this same event being logged,and it being more manageable.

[bsfinkel]

I have the same problem on my Windows 7 Professional 32-bit system. As a test, I went to services.msc, and I stopped the Spybot S&D 2 Updating Service. The Application EventLog 1903 entries continued, even after I had stopped the service. I did not reboot after stopping the service. I checked the started task log (Schtasks /Query /FO /List /V), and the 1903 EventLog entries occur one second after the Updating Service task runs. This leads me to believe that it is this task that is producing the HHCTRL entries.

There are two questions that arise:

1) Why are the EventLog entries being generated? Is the HHCTRL part of HTML Help? I am not sure. If so, what is Spybot doing that causes this entry to be generated?

2) The EventLog says, "The description for Event ID 1903 from source HHCTRL cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer." I have seen this with MANY EventLog entries, and it implies that the application in question, in this case Spybot, has not installed a piece that the EventLog viewer needs to decode the entry. I do not know the internals of the EventLog system, so I have no idea exactly what additional piece is needed in the Spybot distribution and installation.

Some previous poster complained that these entries are too numerous, and they may obscure entries that point to real errors. I do not rely on the EventLog in Windows the same way I relied on the system logs on the IBM mainframe or Unix systems on which I was an administrator. The reason is that many of the entries have no useful information, as I noted above.

--Barry Finkel

[adson3492]

Changing the Spybot Check for updates task from System to my account,then Run only when user is logged on,and run with highest privileges stopped the Event 1903 from being logged in Event Viewer from 11:04 onwards.
Enabling the Check for updates task history after rebooting shows the task having Action started,Action completed when I logged on,and every 5 minutes thereafter.

Only problem is Spybot's Updates logfile isn't showing the check for updates every five minutes,so I guess that wasn't exactly a roaring success. :/

If you prefer not to have Event 1903 happening and would prefer to leave the Check for updates task disabled,that should prevent it.If you do go with that,you ought to make sure you remember to check for updates manually.
Or,if you prefer to reenable the check for updates,having Event 1903 happen doesn't look like it would cause any harm,so it's up to you.

Thanks for this useful information

[bsfinkel]

I am replying because 1) I was part of this thread three years ago, and 2) I am still getting the EventLog entries.

I do not understand what is happening. Before I run a Spybot scan, I always do an update. And that process tells me that I have not updated in x days (if I have skipped one or more days since the last update). So, Spybot is not automatically updating on my system. So, why is an update process checking every 10 minutes? And why is that update process producing the EventID 1903 message? I normally do not look at the EventLog, because it is filled with items such as these, which say, if I interpret them correctly, "some process wrote an EventLog entry, but the installation of that software did not include any 'template' for interpreting that EventLog entry". These EventLog entries are meaningless to me, and I would prefer that they not be in the EventLog. I would not mind the Spybot update process running every 10 minutes, doing something, and then logging the fact.

What exactly is the Spybot update process doing? And can Spybot install the missing "template" so that these Eventog entries contain meaningful information? Maybe someone can give me more info as to what is happening. I did not really understand the last reply from two years ago. Thanks.

[Zenobia]

There is a scheduled task for Spybot to update in your computer's scheduled tasks. It's possible I have reconfigured my own scheduled task doing stuff here in the forum along the way, but if mine is at the default scheduled task then it is a scheduled task set to run at the logon of any user, and then every ten minutes thereafter.

I also update manually, and am told that I haven't updated for x amount of days. I'm not sure why that is, nor am I sure if my scheduled spybot update task ran correctly prior to this, because the History on the task is disabled. However, I enabled History and then ran the task, and the History showed as working. I looked and I also have the HHCTRL in event log, so I presume it's Spybot related and the scheduled update task has been running prior to this.

So, the best course of action now would be for you to ask support about the background updates and the HHCTRL entries:
https://www.safer-networking.org/support/ticket/