Fixing the Microsoft Windows Common Control Library (MSCOMCTL.OCX) Security Update

On August 14, 2012, Microsoft released a security update that included an update to the Windows Common Control MSCOMCTL.OCX:

File name	File version	File size	Date	Time
Mscomctl.ocx	6.01.9834	1,070,152	07-Jun-2012	03:59

Notice the control's date is from June but it was in the August security update.

---

Microsoft Knowledgebase Articles for the Updates

• KB2597986 - for Office 2010
• KB2687441 - for Office 2007
• KB2687323 - for Office 2003

---

Windows Versions

This affects the following versions of Windows:

• Windows XP, Vista, Windows 7 (32/64 bit)
• Windows Server 2003, 2008, 2008 R2

After installing the update, the Windows Common Control Library does not work. The issue seems to stem around a defective installation or registration of the OCX file. This update causes problems with existing Microsoft Access, VB6 and other applications using common controls such as the Treeview and Listbox controls.

The symptoms are rather odd. It's not as if the control is completely missing or not registered. The control exists but does not behave correctly as events are not firing correctly. For instance, the Treeview control don't issue NodeClick events, so any code that expects the expansion of a node to display or load more data fails. It took us a while to discover that a change in this control caused this problem.

In other cases, users are reporting that Microsoft Access locks up and crashes. People are also reporting problems with this in Visual Basic 6 (VB6) applications. Here are additional reports of issues associated with this patch.

---

Impact on Total Access Analyzer

This impacts our Total Access Analyzer product which displays the results of your Microsoft Access database documentation with the Treeview control. This error appears:

Error 459 - Object or class does not support the set of events, Procedure clsFrmExplorer_TAA.InitForm

If your PC received the security update and you're using the Microsoft Access 2010, 2007, 2003, 2002, or 2000 version of Total Access Analyzer, the Treeview control in our Database Explorer view no longer functions properly.

Microsoft has acknowledged problems with their security update that is causing these problems. The issue is caused by a registration of the updated MSCOMCTL.OCX file. Microsoft has released a Knowledgebase article 2687441 addressing this problem entitled: MS12-060: Description of the security update for 2007 Office system: August 14, 2012.

In that article, they mention the known issues with the security update:

Windows Common Control-based embedded ActiveX controls may fail to load within pre-existing office documents, within third-party applications, and when you insert new controls in developer mode. For example, depending on your operating system, you can type the either of the following commands at an elevated command prompt, and then press Enter:

• For 64-bit operating systems, type the following:
  Regsvr32 "C:\Windows\SysWOW64\MSCOMCTL.OCX"
• For 32-bit operating systems, type the following:
  Regsvr32 "C:\Windows\System32\MSCOMCTL.OCX"

The article goes into details about unregistering the control and re-registering it using a batch file calling REGEDIT.EXE.

In our internal testing, we've discovered that the recommended steps don't work in most cases. Just unregistering and re-registering the control doesn't solve the problem. We tried adding a reboot between steps, but that didn't help either. The steps below work consistently. An technical explanation why is given at the end.

Our Steps for Fixing the Registration of the Windows Common Control

While there seems to be nothing physically wrong with the new OCX, we need to register another version to reset it. Here are the steps we discovered to manually repair this issue reliably and consistently:

• Unregister the new MSCOMCTL.OCX and make a backup of it
• Install and register an old (legacy) version of the MSCOMCTL.OCX file
• Replace the legacy control with the new one
• Re-register the new control

---

Windows Command Prompt and Security Permissions

You need Administrator rights to make registry changes. Depending on your operating system and Windows login rights, you may not be allowed to do this.

From your Windows Start button under, All Programs, Accessories, launch the Command Prompt by right clicking on it and choosing "Run as administrator".

You can then copy the Regsvr32.exe command lines described below into the dialog.

---

32 Bit Windows

1. Unregister the new OCX file. Open an instance of the Windows Command Prompt, paste the following command, and press <Enter>:
   Regsvr32.exe /u C:\Windows\System32\MSCOMCTL.OCX
2. Make a backup of the OCX file C:\Windows\System32\MSCOMCTL.OCX to C:\Windows\System32\MSCOMCTL.bak
3. Copy a legacy version of the MSCOMCTL.OCX file to your C:\Windows\System32 folder. For your convenience, a zipped copy from 2011 is here.
4. Register this legacy OCX file with the following command:
   Regsvr32.exe C:\Windows\System32\MSCOMCTL.OCX
5. Unregister this legacy version of the OCX file:
   Regsvr32.exe /u C:\Windows\System32\MSCOMCTL.OCX
6. Delete the legacy OCX file: C:\Windows\System32\MSCOMCTL.OCX
7. Rename the new OCX file we renamed in step 2, back to its original name:
   C:\Windows\System32\MSCOMCTL.bak to C:\Windows\System32\MSCOMCTL.OCX
8. Re-register the new version of the OCX file. Paste the following command and press <Enter>:
   Regsvr32.exe C:\Windows\System32\MSCOMCTL.OCX
9. Reboot the computer.
10. Open Microsoft Access and then retest the control. It should be working at this point.

---

64 bit Windows

The 64-bit steps are identical to the 32 bit version except the folder is SYSWOW64 rather than SYSTEM32:

1. Unregister the new OCX file. Open an instance of the Windows Command Prompt, paste the following command, and press <Enter>:
   Regsvr32.exe /u C:\Windows\SYSWOW64\MSCOMCTL.OCX
2. Make a backup of the OCX file C:\Windows\SYSWOW64\MSCOMCTL.OCX to C:\Windows\SYSWOW64\MSCOMCTL.bak
3. Copy a legacy version of the MSCOMCTL.OCX file to your C:\Windows\SYSWOW64 folder. For your convenience, a zipped copy from 2011 is here.
4. Register this legacy OCX file with the following command:
   Regsvr32.exe C:\Windows\SYSWOW64\MSCOMCTL.OCX
5. Unregister this legacy version of the OCX file:
   Regsvr32.exe /u C:\Windows\SYSWOW64\MSCOMCTL.OCX
6. Delete the legacy OCX file: C:\Windows\SYSWOW64\MSCOMCTL.OCX
7. Rename the new OCX file we renamed in step 2, back to its original name:
   C:\Windows\SYSWOW64\MSCOMCTL.bak to C:\Windows\SYSWOW64\MSCOMCTL.OCX
8. Re-register the new version of the OCX file. Paste the following command and press <Enter>:
   Regsvr32.exe C:\Windows\SYSWOW64\MSCOMCTL.OCX
9. Reboot the computer.
10. Open Microsoft Access and then retest the control. It should be working at this point.

The reason why Microsoft's recommendation to un-register and re-register the new MSCOMCTL.OCX Common Control fails is because it doesn't overwrite the legacy control's registry on the machine. Industry colleague, Andrew Rohm provides this nice explanation:

The problem is that the update leaves some old 2.0 Version entries in the Registry. The previous MSCOMCTL.OCX carried the version number 2.0 (the *File* Version is 6.something but in the registry it's known as Version 2.0).

The new file version is 6.1.98.34 but Version 2.1 in the registry. Here we are talking about registry entry:
HKEY_CLASSES_ROOT\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}

The patch installs the new version but leaves a part of the old registry settings.

By installing and uninstalling the legacy control, it cleans up the 2.0 registry so the new version is installed properly. The offending registry that needs to be deleted is:

HKEY_CLASSES_ROOT\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0

Thank you Andrew for sharing your insight! Microsoft has since provided an update to their page.

Have any suggestions or comments? Head to our blog post Microsoft Windows Common Control Library (MSCOMCTL.OCX) Security Update Requires Fixing and leave us your feedback!