STATUS_ACCESS_VIOLATION (0xC0000005): The memory read error

The 30-second fix: restart and check for obvious culprits

I’ve seen this error pop up on a dozen different machines—once on a client’s Windows 10 laptop that kept crashing every time they opened QuickBooks. The first thing I always try is a full shutdown and restart. Not a reboot, but a Shut down from the Start menu, wait ten seconds, then power back on. That clears the memory map and stops whatever half-broken process might have left a bad pointer.

If the error happens right after you install something, uninstall that program. Had a guy last week who installed a cheap VPN, and boom—0xC0000005 every time the VPN tried to tunnel traffic. Removed it, error gone. Also run a quick sfc /scannow in Command Prompt as admin. It’ll fix corrupted system files in under a minute. Type

sfc /scannow

Still crashing? Move on to the moderate fix.

The 5-minute fix: update drivers and disable shell extensions

This error loves old or buggy drivers, especially graphics and network drivers. I once spent an hour debugging a rendering crash in AutoCAD—turned out the NVIDIA driver was three versions behind. Update your GPU driver from the manufacturer’s site (not Windows Update). For AMD or Intel, same deal. Get the latest stable version.

Next, check for shell extensions that hook into Explorer. Things like Dropbox, Google Drive, or old WinRAR context menu plugins can trigger access violations. Use Autoruns from Microsoft Sysinternals (free tool). Run it, go to the Explorer tab, and uncheck any third-party shell extensions that aren’t essential. Reboot after.

Also, run a memory test. Windows has a built-in tool: type Windows Memory Diagnostic in the start menu, click Restart now and check for problems, let it run. If you see errors, one of your RAM sticks might be going bad. I’ve replaced more RAM than I can count because of this error.

The 15+ minute fix: deep dive into event logs and driver verifier

If the above didn’t work, we’re going deep. Open Event Viewer (eventvwr.msc), go to Windows Logs > Application. Look for a critical error with source Application Error and event ID 1000. The details will show the faulting module—often a .dll file name. For example, ntdll.dll or win32k.sys are common. Google that module name with “0xC0000005” to find exact fixes.

Another step: run Driver Verifier. This tool stresses your drivers to find the bad one. But be careful—if you select all drivers, it can make your system unbootable. Instead, only verify unsigned or third-party drivers. Open verifier.exe, choose Create custom settings, select Select individual settings and check everything except Low Resource Simulation, then choose Select driver names from a list and pick only drivers from Microsoft that are marked Verified. Reboot. If the system crashes with a blue screen pointing to a driver, that’s your culprit.

One last thing: check for malware. I’ve seen rootkits cause access violations by hooking into system calls. Scan with Malwarebytes in safe mode. Boot into safe mode (hold Shift while clicking Restart), run a full scan. If it finds anything, remove it and reboot.

Still getting the error? Try a clean boot: msconfig > Services tab > check Hide all Microsoft services > click Disable all, then Startup tab > Open Task Manager and disable all startup items. Restart. If the error stops, enable services one by one until it comes back. That’s your bad actor.

I’ve had clients where none of this worked, and we had to use System Restore to a point before the error appeared. If you have a restore point, try that. If not, a repair install of Windows (keeping files) is your last resort before a fresh install.

Pro tip: Always back up your data before messing with drivers or registry. This error can corrupt files if it’s happening during writes.