JVM is frequently crashing with a 0xc0000005 exception


Article ID: 160171


Updated On:


Data Loss Prevention Network Monitor


If the environment is having frequent restarts and the resulting JVM crashdumps ( hs_err* files in Vontu/protect/bin ) display an 0xc0000005 exception such as


Current thread (0x11f96c00):  JavaThread "Worker 3" daemon [_thread_in_native, id=8108, stack(0x12c20000,0x12c70000)]

siginfo: ExceptionCode=0xc0000005, reading address 0xfffffff8


Current thread (0x11b65400):  JavaThread "Worker 1" daemon [_thread_in_native, id=6392, stack(0x12c20000,0x12c70000)]

siginfo: ExceptionCode=0xc0000005, reading address 0x13feb003



There may be several causes for this type of exception, but in most cases this is related to enabled DEP ( Data Execution Prevention , http://en.wikipedia.org/wiki/Data_Execution_Prevention  )

In that case you may want to turn off DEP to verify that the crashes no longer occur and then fine-tune the DEP exceptions in the environment.

How to turn DEP on or off can be found in http://technet.microsoft.com/en-us/library/cc700810.aspx and http://blogs.technet.com/b/askperf/archive/2008/06/17/to-dep-or-not-to-dep.aspx


You may also want to check if there are other programs / services running that monitor processes and potentially stop them ( Symantec Endpoint or McAfee ). In this case, disable them and try again and see if they cause the exception. You may see in their specific logs entries that would indicate if a Symantec DLP process has been stopped.

Per http://www.0xc0000005.com/data-execution-prevention.html  


Data Execution Prevention


The nasty 0xC0000005 error may occur because of Data Execution Prevention (DEP) introduced by Microsoft in SP2 and used in later Windows versions. DEP is a set of security features that prevents code execution from non-executable memory segments. In other words,

DEP monitors and ensures that the applications installed on your computer use the system memory in a safe way. Let’s look into this.


The information on your computer is stored as data and executable code, each type of information exploits its own memory segment. The 0xC0000005 error means that a program is trying to execute data as a code from non-executable parts of memory. Such behavior is characteristic of malware and DEP traps attempts to execute a malware code. The 0xC0000005 error message notifies you of such attempts. But many legal software programs use dynamic code generation, and the generated code is not always marked as executable code, which makes such applications incompatible with DEP and results in the 0xc0000005 access violation error.
Otherwise you may review the following references for further troubleshooting







0xc0000005 is a critical Access Violation error that requires your immediate reaction. As a rule, you get the 0xc0000005 error message when you try to start one of your software programs in Windows. After that the program terminates and you can’t get it work. Also, the 0xc0000005 error code may appear in other different error messages, depending on the software you are trying to start or install or the action you are trying to execute on your computer. The most typical causes for the ‘0xc0000005: Access Violation’ error are: corrupt registry, malware, faulty RAM or device driver, incorrectly written, installed or updated software or even Windows security features.