That's interesting, I didn't know. The app does have Direct_Output but the error event gets generated when starting the app from Web Application Administrator, even before executing any code. Or when requesting app_url/WebServiceDispatcher.wso. The OnLoad procedure in the oWebApp object only really reads URL parameters and redirects to the appropriate view accordingly.

The thing is I don't think other third vendor deploying an app to that server would be allowed to change what seems a system dll (
C:\Windows\SysWOW64\ntdll.dll). We use some DLL and OCX controls, could they have unregistered somehow?