0xC0000005 Access Violation

Finding a Solution for the 0xC0000005 Error

This is a fairly common Windows access violation error and hopefully this article will help you resolve the problems you are having.

What Causes Windows Error 0xC0000005

A quick scan of the online technical forums and blogs reveal folks asking for help with this windows error. Your question may be the same as this typical request:

I'm running Windows XP and when I click to start one of my software programs I get this error:

"An application error has occurred and an application error log is being generated. Exception: access violation (0xC0000005), Address"

The error 0xC0000005 is generated by an illegal "memory access violation". This can be caused by anything from faulty RAM, an incorrect/corrupt device driver, poorly written/updated software and more commonly under Windows XP Service pack 2, malware/adware installations.

Usually you get this error message when performing a specific task, and if that happens you need to check the corresponding 3rd party's website/support department to see if they are aware of the problem

..a while back Symantec Antivirus caused the 0xC0000005 error with an additional message about a file called SAVRT.SYS . A simple software update to the Symantec Antivirus cured the problem.

So what can you do...? well below are a couple of suggestions:

0xC0000005 - Resolution Suggestion One:

In many cases this error has been generated by faulty RAM memory. So if you have just upgraded your computer with some new memory and you started getting this error then I would remove them and see if the error goes away. If it does then send the memory back and get a refund!

0xC0000005 - Resolution Suggestion Two:

In Windows XP Service Pack 2 Microsoft introduced Data execution prevention (DEP), a set of hardware and software technologies that perform additional checks on memory to help protect against malicious code exploits. In Windows XP SP2, DEP is enforced by both hardware and software.

Some software/application behaviours are incompatible with DEP - data execution prevention. Applications which perform dynamic code generation (such as Just-In-Time code generation) and that do not explicitly mark generated code with Execute permission might have compatibility issues with data execution prevention. Applications which are not built with SafeSEH must have their exception handlers located in executable memory regions.

Applications that attempt to violate DEP will receive an exception with status code STATUS_ACCESS_VIOLATION (0xC0000005).
 
If an application requires executable memory, it must explicitly set this attribute on the appropriate memory by specifying PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_WRITECOPY in the memory protection argument of the Virtual* memory allocation functions.

If you are having issues with 0xC0000005 errors in DEP and a particular piece of software is causing the offence, contact the vendor for a resolution...

Note: It is possible to "Turn Off" DEP in the boot.ini file but this really would be a last step!

/NOEXECUTE

This option is only available on 32-bit versions of Windows when running on processors supporting no-execute protection. It enables no-execute protection (also known as Data Execution Protection - DEP), which results in the Memory Manager marking pages containing data as no-execute so that they cannot be executed as code. This can be useful for preventing malicious code from exploiting buffer overflow bugs with unexpected program input in order to execute arbitrary code. No-execute protection is always enabled on 64-bit versions of Windows on processors that support no-execute protection.

There are several options you can specify with this switch:

/NOEXECUTE=OPTIN Enables DEP for core system images and those specified in the DEP configuration dialog.

/NOEXECUTE=OPTOUT Enables DEP for all images except those specified in the DEP configuration dialog.

/NOEXECUTE=ALWAYSON Enables DEP on all images.

/NOEXECUTE=ALWAYSOFF Disables DEP. (This setting doesn't provide any DEP coverage for any part of the system, regardless of hardware DEP support. The processor doesn't run in Physical Address Extension (PAE) mode unless the /PAE option is present in the boot.ini file.)

You can read more about DEP at:

http://www.updatexp.com/data-execution-prevention.html 

0xC0000005 - Resolution Suggestion Three:

I have also seen this error in the gaming community when folks have updated drivers for their graphics card. If this happens just roll back your drivers and then "Google" to see if their are any other folks reporting this issue. Also keep an eye on the vendors website to see if they have an update/patch available or coming soon.

0xC0000005 - Resolution Suggestion Four:

Microsoft Internet Explorer 6.0 stops responding when you try to open an HTML document or a Web page. Additionally, you receive the following error message:
Access Violation (0xC0000005 exception)

CAUSE:

This problem may occur when you use Internet Explorer 6.0 to open an HTML document or a Web page that contains SPAN tags. If a SPAN tag is not closed correctly by using the </SPAN> tag, an access violation may occur.

WHY are you using IE6 still??? Upgrade to IE 10 today! 

...and that should have now resolved the 0xC0000005 error for you!

Enjoy!

Kind Regards

Marc Liron - Former Microsoft MVP (2004-2010)