I'm afraid very few people know the root cause of the mysterious 0xC0000018 EXE launch error because Microsoft makes it vague, even until Windows 10. When reading Jeffrey Richter's Programming Applications for MS Windows 4th-ed, I happened to find it out.
If a DLL requires to be loaded at a fixed address(in process virtual address space), but the requirement cannot be fulfilled, Windows asserts the very 0xC0000018 error. But there is no apparent clue to tell which DLL(s) cause the problem. A simple Google search of "0xC0000018" just pops you with lots of posts of baffled users.
To reproduce, you can prepare a solution(Visual Studio term) with one EXE and two DLL, and set both DLL to have linker option /FIXED /BASE:"0x44440000"
and have the EXE implicitly load the two DLLs, then you will see 0xC0000018 error on EXE launch.
And yes, clearing out APPINIT_DLLS
in the registry is your first bet to get rid of the possible culprits. Those DLLs (possibly from malware/spyware) will be loaded into every process you launch so may ruin your live.
I think Microsoft designed this DLL-force-loading facility for developing/debugging purposes, so for normal users, that APPINIT_DLLS
should remain empty.
Then how to pinpoint the actual culprit DLL? Perhaps there is a way, use dumpbin.exe to check every DLL in APPINIT_DLLS
or other possible auto-loaded DLLs(help with AutoRuns), check them one by one with dumpbin -headers
. If there is no .reloc
section, it is a fixed-location DLL.