If you installed security updates MS05-026 (896358) or MS05-001 (890175), creating an instance of HHCTRL outside the Local Machine zone is blocked by default.

The above security updates introduced the UrlAllowList Value Name, a REG_SZ data type, and the MaxAllowedZone Value Name, a REG_DWORD data type, at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions, to enable exceptions to the blocking that was introduced to reduce security vulnerabilities in HTML Help.

To use the UrlAllowList Value Name, simply include the fully qualified file names and site URLs, separated by semi-colons (;). If you wanted to allow Web site http://www.JSIINC.com/help and .chm files at \\JSI001\helpfiles, you would open a CMD.EXE window and type:

REG ADD "HKLM\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions" /V UrlAllowList /T REG_SZ /F /D "\\JSI001\helpfiles;http://www.JSIINC.com/help/"
If you wanted to allow all the Web sites in the Local intranet zone (and the Local Machine zone), you would set MaxAllowedZone to 1:
REG ADD "HKLM\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions" /V MaxAllowedZone / T REG_DWORD /F /D 1
NOTE: Both UrlAllowList and MaxAllowedZone can be used together.

The MaxAllowedZone Value Name can have the following data values and meanings:

   MaxAllowedZone       Local Machine zone       Local intranet zone       Trusted sites zone       Internet zone       Restricted sites zone   
      0    Allowed    Blocked    Blocked    Blocked    Blocked
      1    Allowed    Allowed    Blocked    Blocked    Blocked
      2    Allowed    Allowed    Allowed    Blocked    Blocked
      3    Allowed    Allowed    Allowed    Allowed    Blocked
      4    Allowed    Allowed    Allowed    Allowed    Allowed