TechSpot

XP Event Log - Error 6004

By conrod
Jan 21, 2009
Topic Status:
Not open for further replies.
  1. Hi All,

    First post - and a problem that's driving me nuts!

    On my home Windows XP workgroup I have four PCs (wired connections) and two notebooks (wireless connections) - all running XP Pro (SP3). One PC acts as the main file server - for email storage and to serve two Home Theatre PCs for audio/video streaming. I have an ADSL router which acts as the DHCP server for the network.

    One of my HTPCs keeps producing 6004 errors in the event log: "A driver packet received from the I/O subsystem was invalid. The data is the packet."

    One of these errors (and only one) is generated every time I browse "My Network Places" on this PC in Windows Explorer and click on a shared folder on any of the other machines in the workgroup. Once connected, I can copy files, play audio/video files from that machine with no further errors. All the other machines are OK - i.e. I can browse shared folders on other machines (including the one with the problem) with no errors in the event log.

    So this says to me that the problem is related solely to this one machine. This PC has an inbuilt 100 Mbps Nvidia LAN connection (normally disabled in the BIOS) and a gigabit Realtek card. Thinking this might be hardware related, I re-enabled the 100 Mbps connection and hooked that up to the Ethernet switch instead - but the problem remained.

    A Google search revealed problems a few years ago with McAfee VirusScan 8 and 6004 errors - I'm running the latest McAfee Security Centre on this PC. I've tried disabling the realtime file scanning but this made no difference. But as this AV software is also installed on the other machines, it can probably be ruled out as a suspect.

    The only thing I can think of is that there are three Ethernet switches between the problem machine and the router/DHCP server - I have yet to try physically moving the PC to the main Ethernet switch to see if this makes any difference.

    The topology is as follows:

    -Broadband router/DHCP server connected (100 mbps) to gigabit switch 1.
    -Gigabit switch 1 onward connects to PCs 1 & 2, wireless router (DHCP disabled) and gigabit switch 2.
    -Gigabit switch 2 onward connects to PC 3 and gigabit switch 3.
    -Gigabit switch 3 is connected to PC 4 (the one with the error 6004 problem).

    As everything works OK, it's not a showstopper - other than the event log entry there are no other symptoms/problems. However, I'd rather not have my event log filled with these (apparently benign) error messages, and I'm keen to know why they're occurring!

    Any ideas/suggestions?

    Many thanks,

    Alan
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    FYI, you can copy an Event Error like this:
    Start> Run> type in eventvwr

    Do this on each the System and the Applications logs:
    1. Click to open the log>
    2. Look for the Error>
    3 .Right click on the Error> Properties>
    4. Click on Copy button, top right, below the down arrow
    5. Paste here (Ctrl V)

    It will put the Error in the format below and it will include the Event #m the Source and the Description. Your Error would look like this:
    Event Type: Error
    Event Source: EventLog
    Event Category: None
    Event ID: 6004
    Date: Today
    Time: Now
    User: N/A
    Computer: Yours
    Description:
    A driver packet received from the I/O subsystem was invalid. The data is the packet.

    What it means:
    Possible causes: and Resolutions
    1. McAfee AV patch
    2. Mismatch between the server’s NIC and the switch port. Ensure that the speed and flow control are hard-set on both.
    3. The driver is functioning properly but is logging incorrectly formatted packets in the event log.
    See TechNet HERE
    4. Faulty network card (or network card drivers) - the replacement of the card fixing the issue.

    Source: EventID.net
  3. conrod

    conrod Newcomer, in training Topic Starter

    Thanks for the reply Bobbye. Here's the system event log entry:

    Event Type: Error
    Event Source: EventLog
    Event Category: None
    Event ID: 6004
    Date: 22/01/2009
    Time: 12:53:39
    User: N/A
    Computer: MEDIAPC
    Description:
    A driver packet received from the I/O subsystem was invalid. The data is the packet.

    For more information, see Help and Support Center at http.//go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 0c 00 e0 00 0e 00 00 00 ..à.....
    0008: e8 d4 3e 72 90 7c c9 01 èÔ>r|É.
    0010: 40 00 00 00 00 00 00 00 @.......
    0018: 00 00 00 00 04 00 4e 00 ......N.
    0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
    0028: 00 00 00 00 10 00 00 c0 .......À
    0030: 00 00 00 00 00 00 00 00 ........
    0038: 00 00 00 00 00 00 00 00 ........
    0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
    0048: 6d 00 62 00 00 00 5c 00 m.b...\.
    0050: 44 00 65 00 76 00 69 00 D.e.v.i.
    0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
    0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
    0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
    0070: 69 00 72 00 65 00 63 00 i.r.e.c.
    0078: 74 00 6f 00 72 00 00 00 t.o.r...
    0080: 44 00 4f 00 47 00 48 00 D.O.G.H.
    0088: 4f 00 55 00 53 00 45 00 O.U.S.E.
    0090: 00 00 4e 00 65 00 74 00 ..N.e.t.
    0098: 42 00 54 00 5f 00 54 00 B.T._.T.
    00a0: 63 00 70 00 69 00 70 00 c.p.i.p.
    00a8: 5f 00 7b 00 37 00 35 00 _.{.7.5.
    00b0: 36 00 39 00 37 00 43 00 6.9.7.C.
    00b8: 44 00 42 00 2d 00 33 00 D.B.-.3.
    00c0: 39 00 38 00 36 00 2d 00 9.8.6.-.
    00c8: 34 00 37 00 37 00 37 00 4.7.7.7.
    00d0: 2d 00 41 00 37 00 36 00 -.A.7.6.
    00d8: 41 00 2d 00 46 00 00 00 A.-.F...

    No error gets written to the application event log.

    Since posting, I tried plugging the LAN cable from switch 2 directly into the problem PC (MEDIAPC) - thus bypassing switch 3. The error is still produced.

    It's odd that this only happens when I browse the shared folders across the network in Windows Explorer - loading files in applications is OK. The only other thing that comes to mind is that I have the "Link Shell Extension" add-on installed in WIndows Explorer on this machine, which provides Vista-like hardlink and junction functionality in XP. However, this is also installed on the file server, which does not produce these event log errors.

    I've just noticed that I also get these occasional 4226 warning messages in the system event log:

    Event Type: Warning
    Event Source: Tcpip
    Event Category: None
    Event ID: 4226
    Date: 03/12/2008
    Time: 19:23:10
    User: N/A
    Computer: MEDIAPC
    Description:
    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

    For more information, see Help and Support Center at http.//go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00 00 00 00 01 00 54 00 ......T.
    0008: 00 00 00 00 82 10 00 80 ....‚..€
    0010: 01 00 00 00 00 00 00 00 ........
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........

    I do have 14 network folders mapped as network drives in Explorer on this machine. There doesn't seem to be a correlation between this warning and the 6004 errors in the log though. Could there be a connection though?

    Thanks again.
  4. conrod

    conrod Newcomer, in training Topic Starter

    Hi again Bobbye.

    Re the above possible causes and resolutions:

    1. The AV patch I've seen mentioned related to version 8 from 2004, and I couldn't find a reference to it now on the McAfee site
    2. There is no facility to hard set individual port flow control and speeds on my switches - they're all autosense.
    3. I found this link previously, and couldn't make any sense of it! :eek:
    4. It was still there when I switched to the motherboard LAN port - so that seems to rule out a hardware fault.

    All very puzzling!
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Ignore Warnings. What you copied simply means you have tried 3 times (usually) to access the internet and failed. At that point and automatic limit is imposed, which is what the Warning is telling you.

    I think more help might be available in the General Hardware Forum HERE

    Or the Networking Forum HERE

    It would be helpful if you made a reference to this thread:
    http://www.techspot.com/vb/showthread.php?p=712299#post712299

    I don't want to shortchange you and the problem has exceeded my level of expertise.
  6. conrod

    conrod Newcomer, in training Topic Starter

    No worries - thanks for your help Bobbye. I'll need to pursue this problem further, as it's now causing real problems rather than being an academic curiosity! A movie I was streaming from the file server stuttered tonight, and then the MPC media player froze. A look at the system event log revealed four of these errors in rapid succession at that time.

    Thanks again.
  7. conrod

    conrod Newcomer, in training Topic Starter

    Dummy post to get my post count to 5 so I can paste a URL link back to here from the network forum!
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.