HHCTRL Revisited? RRS feed

  • Question

  • Windows XP Professional SP3

    I've moved this from another forum...  I believe I may have a security issue and this "may" be related.  What has prompted me to ask this, other than the proliferation of these events in my Application Event Logs, which seems to be coincidentally concurring with some keyboard oddities that are not generating errors.  I have observed that when I'm active on the internet, at some point, my keyboard starts interchanging characters.  This is limited in application scope.  It occurs in all internet browsers, including iexpler.exe.  It occurs in the dialog boxs generated by the system; but, it does not appear in independant applications.  If I disable my local area connection to the internet, the problem disappears.  If I close "all" the browsers, it disappears.  It generates no 'warnings' or 'errors' in the event log.  However, around the same time this started happening, and it *may not* be related.  This informational event started showing up in the log:  Here is the post, as I placed it under Network Security.

    Recently, my Evenvwr/Application Log has been filling up with this event:

    • Event Type: Information
      Event Source: HHCTRL
      Event Category: None
      Event ID: 1904
      Date: 07/25/2012
      Time: 2:15:08 PM
      User: N/A
      Computer: WORKHORSE
      The description for Event ID ( 1904 ) in Source ( HHCTRL ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: about:blank, http://go.microsoft.com/fwlink?LinkID=45840.

    If I'm understanding correctly; this is a normal response and designed in as a response to an exploit discovered in Vulnerability in HTML Help Could Allow Remote Code Execution (896358).

    However, the number of events are getting out of hand.  I'm wondering what I might do to try and figure out, what is actually causing this event, where and who it's coming from.  I've just increased the size of my log file, so Historically, I don't know exactly when it started.

    I also haven't been able to yet determine if any concurrent behavior on my part for a clue.  I can go hours with no entry.  Is there any way to tag this process, whichever process it is, and determine what's going on with something like Process Monitor?  Although, I've never been able to observe the activity in the Process Explorer.  Although it appears to occur sometimes while I'm using MMC and examining the help files.  And, sometimes it appears to happen while the machine is idle with only MSE, and standard processes running in the background, as far as I can tell.

    Any help on this would be much appreciated.  As I said earlier, I realize that the message indicates it's an information message in response to the exploit found in Win XP Help SP2, and I'm running SP3.  But, since it has started showing up, I've been experiencing some unusual keyboard behavior, which I think is premature to go into.  Right now, I'm just troubleshooting.  The 1904 event, and the odd keyboard behavior, may not be related; but, I started having both things happen around the same time... something is going on.  

    Thanks ahead of time for reading, any help is appreciated.

    What we need a signature?

    Friday, July 27, 2012 4:24 PM