1

On a virtualized (ESXi 4.1) Windows Server 2008 SP2 32-bit machine which is used as a terminal server, I occasionally (approximately 1-3 event log entries a day) see applications fail with an 0xc0000005 error - apparently a memory access violation.

The problem seems quite random and only badly reproducable - applications may run for hours, fail with 0xc0000005 and restart quite fine or just throw the access violation at startup and start flawlessly at the second attempt.

The names of executables, modules and offset addresses vary, although a single executable tends to fail with same modules and the same memory offset addresses (like "OUTLOOK.EXE" repeatedly failing on module "olmapi32.dll" with the offset "0x00044b7a") - even across multiple user's logons and with several days passing without a single failure inbetween. The offset addresses seem to change across reboots, however. Only selective executables seem affected by the problem, although I may simply not be seeing a sufficient number of application runs from the other ones.

I first suspected a possible problem with the physical machine's RAM, but ruled this out as a rather unlikely cause - the memory comes with ECC and I've already moved the virtual machine across several times, without any perceptable change.

I've seen that DEP was enabled in "OptOut" mode on this machine:

C:\Users\administrator>wmic OS Get DataExecutionPrevention_SupportPolicy
DataExecutionPrevention_SupportPolicy
3

and tried changing the policy to OptIn via startup options:

bcdedit.exe /set {current} nx OptIn

but have yet to see any effect - I also would expect Outlook 12 or Adobe Reader 9 (both affected applications) to play well with DEP.

Any other ideas why the apps may be failing?

2 Answers 2

1

Every time I've had problems with 0xc0000005 errors on a Terminal Server, it turned out to be a problem with DEP.

Have you tried setting the DEP mode back to "OptOut", then explicitly list all of the binaries that are giving you trouble?

1
  • Currently it is set to AlwaysOff - and yet the faults occured 6 times within the last week.
    – the-wabbit
    Nov 27, 2011 at 7:03
0

Sounds like a bad pointer or some sort of memory overlap in the code of the application to me. Have you checked to see if this is a known bug with outlook and/or adobe?

1
  • Mh, yes - I could not find anything that would back the theory. And in the meantime there were updates to both Office and Adobe Reader packages - the memory violations still occur.
    – the-wabbit
    Oct 12, 2011 at 10:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .