Log Dejargonizer

Windows Application Log · Event 1005

Event 1005: Windows could not read a running program's file

A program was closed because Windows could not read part of its own executable or a library from disk. It is not a coding bug like Event 1000 — the program was running fine until the storage underneath it stopped answering. That makes it a disk, network, or antivirus problem, not an application one.

Also written as Application Error 1005Event ID 1005 application errorin-page error application

What it means for you

On a personal computer

A program you were using was shut down because Windows suddenly could not read the file it was running from. If the program lives on a USB drive, an external disk, or a network folder, the connection dropped. If it lives on your main drive, either your antivirus grabbed the file mid-use or the drive is having trouble reading it — and the second possibility is worth checking today, not next week.

For an analyst

Read this as a storage-path event that happens to be filed under Application Error. Windows demand-pages executable images, so a read failure against a mapped section terminates the process with STATUS_IN_PAGE_ERROR rather than an access violation. Check the System log for disk, storage controller, or SMB events at the same second — those name the actual fault.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Log Name:      Application
Source:        Application Error
Event ID:      1005
Level:         Error
Computer:      DESKTOP-WKS042

Windows cannot access the file  for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program ReportViewer because of this error.

Program: ReportViewer
File: \\FS-01\apps\reportviewer\ReportViewer.exe

The fields that decide it

Everything else in the log line is context.

File path
Which file could not be read. This is the field that decides everything else.
  • A path on a mapped drive or UNC shareThe share went away mid-execution. Look for SMB client events in Microsoft-Windows-SmbClient/Connectivity.
  • A path on a removable or external driveThe device disconnected, slept, or lost power. Expect a System-log disk event at the same time.
  • A path on the system driveThe most serious case. Either a real read failure on the disk or a security product interfering with a file already in use.
Program name
The process that was terminated. Incidental — it is the victim, not the cause.
Reasons listed in the message
Windows offers a fixed list — network connection, the disk the file is stored on, or the storage drivers — because it genuinely does not know which. The event itself cannot narrow it down; the System log can.
Timestamp
Match it against the System log to the second. A disk, storahci, or SMB event in the same window turns a vague message into a specific diagnosis.

Ordinary reasons this happens

Most of the time it is one of these.

  • A program launched from a network share when the share, the VPN, or the wireless connection dropped.
  • An application running from a USB or external drive that went to sleep or was unplugged.
  • An antivirus or endpoint agent quarantining or locking a file that was already mapped into a running process — a false positive on a legitimate program produces exactly this.
  • A Windows or application update replacing files underneath a process that was still running.
  • A virtual machine whose datastore stalled long enough for the guest's I/O to time out.

When it is not ordinary

Deliberate tampering with an on-disk binary while it is executing.

What gives it awayThe file is a security agent or a system binary on the local disk, there is no storage error in the System log at the same time, and a file-modification or deletion event exists for that path.

ATT&CK T1562.001

Destructive activity against files in use.

What gives it awayMultiple different processes hit within a short window, all naming files on the same volume, with no corresponding disk hardware events.

ATT&CK T1485

What to do next

  1. Read the file path first. Local, removable, or network determines everything that follows.
  2. Open the System log at the same timestamp. Disk Event 7, 11, 51, or 153, a storahci Event 129, or an SMB client connectivity event will usually be sitting right there and will name the real fault.
  3. If the path is on a network share, check whether the session dropped. Running executables directly from a share is fragile by design — a brief interruption kills the process.
  4. If the path is local, check the antivirus quarantine and exclusion logs for that exact file before assuming hardware.
  5. If nothing in the security product explains it, check the drive: `Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, HealthStatus` and the drive's SMART data.
  6. Verify the file is still intact and correctly signed: `Get-AuthenticodeSignature '<path>'`. A file that reads fine now but failed then points at intermittent storage; a file that is missing or unsigned points somewhere else entirely.

Queries to run

powershell The file path is in the message body, not in a named field. 
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Application Error'; Id=1005} -MaxEvents 30 | Format-List TimeCreated, Message
powershell The storage events that would explain a 1005. Line the timestamps up against the Application-log entry. 
$t=(Get-Date).AddDays(-7); Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$t; Id=7,11,51,129,153} | Select-Object TimeCreated, Id, ProviderName, Message
kql Rare enough across a fleet that every hit is worth reading individually. 
Event | where EventID == 1005 and Source == 'Application Error' | project TimeGenerated, Computer, RenderedDescription | order by TimeGenerated desc
powershell Confirms whether the file on disk is still the file it should be, which separates a storage fault from tampering. 
Get-AuthenticodeSignature 'C:\Path\To\program.exe' | Select-Object Status, SignerCertificate

Common questions

What is the difference between Application Error 1000 and 1005?

1000 means the program crashed executing its own code — a bug, a bad add-in, a corrupted setting. 1005 means Windows could not read the program's file from storage while it was running, so it terminated the process. 1000 points you at the application; 1005 points you at the disk, the network share, or whatever is interfering with the file.

Why does Windows say the disk 'may be missing' when my disk is clearly there?

Because Windows genuinely does not know which of several things went wrong, so the message lists all of them. The read failed, and from the memory manager's point of view a disconnected network share, a sleeping external drive, a failing sector, and a driver timeout are indistinguishable. The System log at the same timestamp is what tells them apart.

Can antivirus cause Event 1005?

Yes, and it is a common cause on machines with healthy disks. If a security product quarantines, locks, or deletes an executable or DLL that is already mapped into a running process, the next demand-page read against it fails and Windows terminates the program. Check the security product's quarantine and detection history for that exact file path before investigating hardware.

Does Event 1005 mean my hard drive is failing?

It can, and that possibility is worth ruling out first when the file is on the system drive. Check the System log for disk events at the same time and look at the drive's SMART data. If the file was on a network share or a removable drive, the far likelier explanation is that the connection dropped, and the drive is fine.

Read next

Vendor documentation

Last reviewed 7 September 2026