regedit.exe - Application Error (0xc0000005)

Hi all.

I try to open/run/execute regedit.exe, under Windows XP Home SP2, with all the updates as of Sept 15 2006.
Wherever I move a copy of this file, when I try to run it I get the following error-window:

regedit.exe - Application Error
The application failed to initialize properly (0xc0000005). Click on OK to terminate the application.

If I change the name of the file to *.exe (for example regedit’.exe) it runs, also if I change the extension to .com, I get regedit.com which also runs OK.

I ran countless malware cleaning tools, and my systems comes clean. I ran sysfilecheck. I googled this problem, and I can’t find something quite like it. Whatever fix I found close to my problem, didn’t work for me.
My registry doesn’t have the nasty key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM] which causes Internet Explorer to bring the same error, (0xc0000005).

Any help would be much appreciated.

Where do you think I should also post this question, like to the avast team, other antivirus companies, microsoft etc?

Thank you,
Adrian

This really is an MS issue.

The error 0xc0000005 is an access violation or ‘Access is denied.’ Are you trying to do this from a limited user account or the administrator account ?

See http://support.microsoft.com/kb/256986/.

A google search for ‘0xc0000005 regedit.exe’ without the quotes returns many hits, this is just one of them.
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=707007&SiteID=1 Although this doesn’t directly solve the problem the last post gives a hint that a different copy of the file in a different location works. So at worst if you have this file it is a work around.

Those errors are also often caused by faulty ram.
Go to http://www.memtest86.com , download their memory test for either floppy or CD,
follow the instructions and reboot to the memory test. You will need to let it run for several hours.

If it is a worm that has changed the permissions or is effecting this it is likely to be effecting two other files, taskmgr.exe and msconfig.exe. The obvious reason for this is to stop you killing the worm/virus process, startup entry and registry keys.

For this reason I have an folder C:\Emergency Utilities, with the three files with slight differences to circumvent this problem so you can still run the programs:
regedit.com, the .exe changed to .com as that still works but takes priority over an exe file.
taskmgr1.exe, the slight name change should also get round the problem.
msconfig1.exe, the same name change as above.

I don’t know if the other two files are also effected, if not then I think it may not be this type of attack and is a windows issue. If they are effected also then try copying the files into another location and rename them them and see if you can run them. If you can you should be looking for Processes, startup entries and associated registry entries that might be being hidden by this denial of permission on the files, etc.

  1. DavidR quote: This really is an MS issue. The error 0xc0000005 is an access violation or ‘Access is denied.’ Are you trying to do this from a limited user account or the administrator account ?
    Answer: Administrator account.
  2. DavidR quote: http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=707007&SiteID=1
    Answer: Running C:\WINDOWS\ServicePackFiles\i386\regedit.exe or any other copy of regedit.exe, wherever it might be placed, leads to the same error, as long as I don’t change the file name. (Still same error when typing REGEDIT using only caps in the “Start > Run:” box, this one is cute). (Also funny, my Win XP valid copy is not Duch, it is English)
  3. Polonus quote: This has to do with an error in Sound Blaster driver. There is a problem there, re-install the corrupt driver.
    Answer: Hi Polonus, and Thank you! I have a SoundBlaster drive indeed, and I installed the latest driver for Windows XP for SoundBlaster 16, at your advice, v.5.2.3718.0, 10/1/2002, by Microsoft. Darn it, no change in the regedit problem. Also, I use this sound drive, with the same hardware configuration, on other Hard Disks with Windows XP SP2 and 2k SP4, but I have no regedit problem.
  4. Bob quote: Those errors are also often caused by faulty ram.
    Answer: Hi Bob, and Thank you! I have several Hard Disks in this PC, some with Windows XP SP2, some with 2k SP4, and I don’t have this problem on any other Hard Disk, in any other configuration, using always the same RAM.
  5. DavidR quote: If it is a worm that has changed the permissions or is effecting this it is likely to be effecting two other files, taskmgr.exe and msconfig.exe. The obvious reason for this is to stop you killing the worm/virus process, startup entry and registry keys. For this reason I have an folder C:\Emergency Utilities, with the three files with slight differences to circumvent this problem so you can still run the programs:
    regedit.com, the .exe changed to .com as that still works but takes priority over an exe file.
    taskmgr1.exe, the slight name change should also get round the problem.
    msconfig1.exe, the same name change as above.
    Answer: I also have a folder EmergencyUtils with Copy_of_MSConfig.exe, Copy_of_Regedit.com, Copy_of_Taskmgr.exe, as per http://windowsxp.mvps.org/ToolsQuit.htm and Doug Knox, http://www.dougknox.com/xp/utils/xp_emerutils.htm. As I mentioned in my first post, I can run regedit if I change the filename or the extension to .com. So I have a work-around. But I still am striving to find the bug that causes this error.
    Also, quote from http://windowsxp.mvps.org/ToolsQuit.htm
    These viruses terminate regedit.exe / msconfig.exe / taskmgr.exe.
    W32.HLLW.Kefy
    Backdoor.IRC.Yoink.A
    W32.HLLW.Cydog@mm
    Backdoor.Volac.dr
    W32.Kwbot.R.Worm
    W32.Erkez.B@mm
    W32.Spybot
    W32.Mytob.LD@mm
    The following viruses delete Regedit.exe, Regedt32.exe, Msconfig.exe, Taskmgr.exe
    W32.Petch.B
    W32.HLLW.Maax.B@mm
  6. DavidR quote: I don’t know if the other two files are also effected.
    Answer: They are not affected.
  7. BUT: as in this post, from somebody else back in 2004: http://discussions.virtualdr.com/archive/index.php/t-156941.html, I have this problem with other programs, notably any executable named setup.exe. If for example I make a txt file, david.txt and then I compress it into an SFX, self-executable archive, and I rename the rezulting .exe file to setup.exe, when I try to run this setup.exe, instead of getting back david.txt, I get the same error!!! As David said, “If it is a worm that has changed the permissions or is effecting this it is likely to be effecting … other files. The obvious reason for this is to stop you killing the worm/virus process, startup entry and registry keys.”
    Thank you all very kindly, and please lets not give up,
    Adrian

Hi agoc,

Still I insist this is a probllem caused by some executable initializing in a wrong way.
The same identical error you can get when you cannot initialize an executable for instance firefox.exe because of a dll problem, but then it did not take the whole OS down… What did you upgrade recently, what did you alter to cause this fatal error? You could sniff through your registry also because there could be an awful long expression there.

polonus

  1. There is no difference in Upper or lower case in Windows file names they are treated the same, so unless you copy and change the filename as suggested it will be treated no differently to the lower case file name.
  2. Glad that you use some of Doug Knox’s utilities also, the idea of the work around is to be able to use the regedit to be able to try and find/identify the culprit if it were a virus/worm responsible. However, if it is a bug or a windows problem then that won’t help to cure the bug or find the fault. Sorry I missed the bit about you could run it if you changed the file type to com.
  3. If the other two aren’t effected I would say it is less likely to be malware, but not impossible.
  4. I’m unsure how the self extracting zip file example can be used in the same context (even though this one is named setup.exe), but it is strange to get a permissions error.

MS windows\system32\setup.exe isn’t usually run from the command line and if I try to run it I get a pop-up see image but not an error. There are so many programs that use setup.exe as their installation file name (15 in my C: drive alone) that along with the MS one it might be a target.

I don’t know enough about the workings of how these permissions might be changed to have this effect, I doubt it is a simple as changing attributes or file type context as that would effect all .exe files so it is more likely a registry entry for setup.exe and this may be why regedit.exe is also effected so you can’t check and edit any changes. So now you know how to get regedit working check out the setup.exe entries if there are any.

Hi friends,
I am really impressed by your willing to help, the world would be not just a better place, but a wonderful place, period. (Forget wars and greed and violence!).
I tinkered more, and more, and then some, and I focused on all the generous and disinterested input I got from you, and also on the fact that on the other Hard Disks/configurations that I have with Windows XP I don’t get the regedit.exe error. So!.. one of the differences between the culprit config and the other, working configs was that I had CleanSweep installed on the culprit config. I had an inspired hunch to uninstall CleanSweep, and the problem went away, pronto! So obviously, CleanSweep was preventing me from running regedit.exe or ANY program’s setup.exe (not just the example I chose with the renamed SFX to setup.exe), maybe other executables too.
I really feel that I wouldn’t have figured that out without your help and encouragement to make me think deeper, in perspective, and with more determination. In other words, before your help I felt like just giving up and resigning to using a work-around.
I know I could emulate your help, and myself try to be helpful to other folks with computing problems, technical problems, or any other problems indeed, but knowing my lazy and selfish self, I don’t think I’ll be able to bring myself to doing much of that, or at least I won’t be up to your level of competence. I could blame it on my middle-eastern upbringing, but I won’t.
Thank you again,
Adrian

Thanks for the valuable feedback about CleanSweep. I have no idea why it would cause this if it were going to intercept something like this you would at least hope it would pop-up a confirmation that you wanted to let this run, a little like ScriptTrap or other configurable script blockers/interceptors instead of causing a permissions error.

I’m glad that you have now resolved the problem, a belated welcome to the forums, any help you can give others would be appreciated.

CleanSweep, just another ‘fine’ Symantec tool. ;D
Just my 2cents worth.