Diagnosing errors in Windows

Note: If you run a Dell XPS 630i, this guide can't help you due to a hardware issue with this system's entire manufacturing line. This page contains information on how to diagnose your error logs. If the log has been closed, you can find it again in your \World of Warcraft\Error\ folder.

Please be sure to scan through EVERY section as a crash log can show multiple issues needing to be resolved. =Error Info=

Cache
Program: C:\Users\Public\Games\World of Warcraft\WoW.exe File: .\DBCache.cpp

This is a cache corruption issue. To solve this issue, delete the

C:\Users\Public\Games\World of Warcraft\Data\Cache\

and

C:\Users\Public\Games\World of Warcraft\Cache\

folders.

Keylogger
The main indicator here, is the Internal Battle.net Error. This means that Warden is crashing - usually from finding something that shouldn't be running, but occasionally from a firewall or antivirus. Assertion failure! Program:	C:\Users\Public\Games\World of Warcraft\WoW.exe ProcessID:	XXXX Expr:	Internal Battle.net Error: Shut down all firewalls or antiviruses you have running.

If this doesn't fix the issue, start with Removing keyloggers. If that doesn't fix it, move on to method 1 of Removing rootkits.

=Crash Address= There are some crash addresses which are ALWAYS caused by the same issue. As such, these will be dealt with in this section. This section references this info: The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "xxxxxxx".

Bypassing Launcher
When wow requires a patch and the user bypasses the launcher and launches WoW directly via the WoW.exe file, wow will ALWAYS crash to this crash address. The instruction at "0xXXXXXXXX" referenced memory at "0x0000012D". The fix is of course to run the launcher and allow the launcher to patch fully.

Memory related issues
Memory issues usually can be figured out pretty easily. It's usually one of the following crash addresses, however can be anything at all provided the first line in the Stack Trace points to then the 2nd line is the location of your WoW.exe file.

The instruction at "0x20000000" referenced memory at "0x20000000". The memory could not be "executed".

The instruction at "0x08000000" referenced memory at "0x08000000". The memory could not be "executed".

The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "executed".

The instruction at "0xXXXXXXXX" referenced memory at "0x00000246". The memory could not be "read".

These crash addresses are generally seen with mismatched RAM, physically damaged RAM, incorrect voltage or timings for the RAM, or a motherboard missing a BIOs update.
 * Users with P5Q motherboards should update their BIOs to solve their crash.
 * CPU-Z can show mismatched RAM. Never run mismatched RAM (ie 2 different sticks of RAM with different voltages and/or timings).
 * Run 4+ hours of memtest86 to check for physical damage. Even 1 error is bad.
 * Double check the RAM timings and voltage compared to what the RAM itself is rated at, what the motherboard will support, and what things are actually set to in the BIOs.

Rootkit with keylogger
Any "executed" error that doesn't fall into the Memory related issues diagnosis is at the very least a keylogger. As is any crash that points then Battle.net.dll, just Battle.net.dll or points to WoW.exe.

The instruction at "0xXXXXXXXX" referenced memory at "0x00000063". The memory could not be "read".

The instruction at "0xXXXXXXXX" referenced memory at "0x00000246". The memory could not be "read".

Please also see Stack Trace (Using DBGHELP.DLL).

To remove this malware from your system, follow the instructions on Removing rootkits.

Antivirus/firewall interference
If your antivirus is interfering with the game, usually you'll see an 'executed' error, where the instruction matches the reference "0x0000000x".

However, the main difference is that below the Loaded addons section this will appear:

Patch data download failed. Error downloading patch data from server 'http://enUS.patch.battle.net:1119/patch', result code 2 Manifest is valid.

You will need to either add WoW.exe, Launcher.exe and Repair.exe to the list of exceptions in your Antivirus/Firewall, or shut it down temporarily altogether.

Deliberate blocking
If you're playing from a school, dorm, public wifi, or your workplace blocks torrents you'll generally see the following if the place is blocking the download: Patch data download failed. Failed to download manifest. Failed to download manifest from server: 'http://ak.worldofwarcraft.com.edgesuite.net/wow-pod-retail/NA/config_recommended_na_1_bgdl_pfil.xml' InstallID: 'WoW', result code 2 Manifest is valid.

Unfortunately, the Launcher requires an updated manifest & torrent info, and as such this download tends to get blocked.

File Corruption
If you have file corruption, you'll see something similar (but not necessarily exactly the same): Failed to read file from local. Details: (Streaming Status: Enabled / Mfil Rdy / Data Rdy, Build: 14007) [1] err=0 text=SFileReadFile - WORLD\WMO\CATACLYSM\TWILIGHTSHAMMER\TWILIGHTSHAMMER_ALTARASCENSION_000.wmo - Data/wow-update-13164.MPQ [0] err=-2062548855 text=System_Mopaq::DeltaData::ReadSource - Read source error WORLD\WMO\CATACLYSM\TWILIGHTSHAMMER\TWILIGHTSHAMMER_ALTARASCENSION_000.wmo - Data\world.MPQ 1058372 Storm Error Msg:Reached the end of the file.

In this case, find any \Data\Cache\patch-base-xxxxx.MPQ or \Data\wow-update-xxxxx.MPQ file (as mentioned in the crash log) and delete it. In this case, delete \Data\wow-update-13164.MPQ. When you reload WoW, it'll restream in to you.

=Loaded Addons Section= You can skip this section if the loaded addons section looks like this:

Current Addon: (null) Current Addon function: UNKNOWN Current Addon object: (null)

If any of those 3 lines show anything but the above, then the addon named is the cause of your crashing. Update it, or remove it.

This is an example of an XPerl crash:

Current Addon: XPerl_RaidFrames Current Addon function: XPerl_Raid_Grp2UnitButton3nameFrame:SetBackdrop Current Addon object: (null)

=GxInfo= Shader Model: 3_0 Vertex: vs_3_0 Pixel: ps_3_0 If each line doesn't have 3_0 output at the end as above, take WoW out of DirectX11 mode, as when Wow is running in DX11 mode, the logs change completely, and it makes it almost impossible to properly diagnose the cause of the problems. Run wow again until it crashes again, and then start the diagnosis with the new DX9 log.

If it doesn't crash again, then chances are that the graphics card driver is experiencing issues in DirectX10/11. Keep WoW out of DX11 until such point that you can update your graphics card driver.

=Stack Trace (Manual)=

Check the first 3 lines in the [Current Thread] section. If it points to where your WoW.exe file is located, skip ahead to Loaded Modules.

nvd3dum.dll
This means the nvidia driver is crashing. Visit Nvidia's website to download the newest driver. When installing, be sure to do a CLEAN install (it's an option), as well as a CUSTOM install (also an option). Do not install either of the 3D drivers unless you use the 3D equipment.

This crash can also be caused by a video overlay program, such as MSI Afterburner, EVGA Precision, etc. If running one of these types of programs, shut it down completely and retry wow.

Continued crashing
If a user continues to crash on the graphics card driver after updating them, this then points to outdated motherboard chipset drivers. Visit the system's manufacturer's site to download the drivers. If the user built the system themselves, they should be able to find and update their drivers on their own.

REINSTALL the graphics card driver. This is required.

atiumdag.dll
This means the ATI graphics card driver is crashing. Visit AMD's website and use the tool on the top right hand of the page to find the newest driver revision.

This crash can also be caused by a video overlay program, such as MSI Afterburner, EVGA Precision, etc. If running one of these types of programs, shut it down completely and retry wow.

igdumd32.dll
Note that your graphics card is no longer supported for WoW. You can attempt updating it, however if that doesn't stop the crashes, you'll need to open your \World of Warcraft\WTF\Config.wtf file with notepad, and add the following line to the bottom of the file, and save it: SET fixedfunction "1"

d3d9.dll
This is usually the graphics card driver crashing, however it can be DirectX itself crashing if the user is running an un-updated Operating System. Do your windows updates. If this doesn't fix it, update your graphics card driver.

Battle.net.dll
This is caused by Malware. Run method 1 on Removing rootkits.

=Stack Trace (Using DBGHELP.DLL)=

--- Thread ID: 3436 [Current Thread] --- 00000003 +0 (0x0027EB20,0x0027EFD4,0x0027EB24,0x0DCDBCD0) 00200202 +0 (0x00000000,0x00000000,0x00000000,0x00000000)

If the first 1 or 2 lines in this section point to (as above) then the problem is 1 of 2 issues:
 * 1) You're experiencing Antivirus/firewall interference (as above).
 * 2) You're infected with malware.  Run method 1 on Removing rootkits.

Known addresses for malware:
 * 00000001
 * 00000002
 * 00000003
 * 00200202
 * 00200206
 * 00200246

=Loaded Modules= In this area, you can generally search for "-0000-" on the page, and if it points to something in the Loaded Modules section, it'll be the cause of the crash.

However, in other cases, nothing really pops out. In this case, you should check the first 3 or 4 loaded modules. This is the order that you should always see in loaded modules:
 * WoW.exe
 * graphics card driver (some cards will have a 2nd graphics card driver loaded third, this is ok)
 * Battle.net.dll


 * If Battle.net.dll is second, it can sometimes indicate a keylogger. See Removing keyloggers
 * If "nvStereoApiI.dll" is showing before Battle.net.dll, uninstall "Nvidia 3D driver" - newer driver revisions will have 2 separate 3D drivers.
 * If your antivirus shows up before Battle.net.dll, this indicates that Warden is experiencing issues with your antivirus, and you should add Wow's folder to the list of exceptions.

Keylogger
If you see .auth anywhere in the Loaded Modules, 100% guaranteed theres a keylogger on the system. Start with Removing keyloggers, and if that doesn't work, follow up with Removing rootkits.

msacm32.drv
This is one of the most common crashes. This crash is caused by outdated soundcard drivers. Update the driver. If updating the driver doesn't work, you'll need to right-click your Launcher.exe shortcut, select Properties, and in the target field, add a space to the end, and then -nosound Hit Apply, then OK, and launch WoW via that shortcut you modified.

(Random numbers).txt
This error is caused by a keylogger. Start with Removing keyloggers. If that page doesn't resolve the issue, move on to Removing rootkits.

=Memory Dump=

Cache
To figure out if you have a cache error or not, just search the dump for the word Cache.

0019D200: 4A 00 00 00 43 3A 5C 55 73 65 72 73 5C 74 68 65 J...C:\Users\\AppData\L 0019D220: 6F 63 61 6C 5C 42 6C 69 7A 7A 61 72 64 20 45 6E ocal\Blizzard En 0019D230: 74 65 72 74 61 69 6E 6D 65 6E 74 5C 42 61 74 74 tertainment\Batt 0019D240: 6C 65 2E 6E 65 74 5C 43 61 63 68 65 5C 00 00 00 le.net\Cache\...

This represents a cache corruption. This means the last time you played wow, wow closed incorrectly, and it corrupted the folder. To fix this issue, delete the cache folder. The good thing with this type of error, it'll tell you EXACTLY which Cache folder it is (Wow uses at least 3 due to battle.net). The address of the folder needed to be deleted can be found in the memory dump. In the above case, its C:\Users\ \AppData\Local\Blizzard Entertainment\Battle.net\Cache\ where is the username on the OS.

Cache errors can also look like:

001FF8D0: D4 F8 1F 00 43 61 63 68 65 5C 57 44 42 5C 65 6E ....'''Cache\WDB\en 001FF8E0: 55 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 US'''..............

In this case, we go up to the 3 lines where it states the error #:

ERROR #132 (0x85100084) Fatal Exception Program: C:\Users\Public\Games\World of Warcraft\WoW.exe

And it'll tell us where the Cache folder is: C:\Users\Public\Games\World of Warcraft\

Delete both the \World of Warcraft\Cache\ folder and the \World of Warcraft\Data\Cache\ folder.

=Hardware= If running Vista, and you don't have at least Service Pack 1 installed, wow can randomly crash due to an error in Vista. Your hardware section will look like this:

Os Version: 6.0 Os Service Pack: 0.0

Service Pack 1 is required to not have Vista crash WoW, however if you want support in WoW, Service Pack 2 is required. As well, if you wish to run DX10/DX11 mode in WoW, Service Pack 2 (plus later minor updates) are all required.

Service Pack 1 is required for Windows 7.