XP Event Log - Error 6004

Hi All,

First post - and a problem that's driving me nuts!

On my home Windows XP workgroup I have four PCs (wired connections) and two notebooks (wireless connections) - all running XP Pro (SP3). One PC acts as the main file server - for email storage and to serve two Home Theatre PCs for audio/video streaming. I have an ADSL router which acts as the DHCP server for the network.

One of my HTPCs keeps producing 6004 errors in the event log: "A driver packet received from the I/O subsystem was invalid. The data is the packet."

One of these errors (and only one) is generated every time I browse "My Network Places" on this PC in Windows Explorer and click on a shared folder on any of the other machines in the workgroup. Once connected, I can copy files, play audio/video files from that machine with no further errors. All the other machines are OK - i.e. I can browse shared folders on other machines (including the one with the problem) with no errors in the event log.

So this says to me that the problem is related solely to this one machine. This PC has an inbuilt 100 Mbps Nvidia LAN connection (normally disabled in the BIOS) and a gigabit Realtek card. Thinking this might be hardware related, I re-enabled the 100 Mbps connection and hooked that up to the Ethernet switch instead - but the problem remained.

A Google search revealed problems a few years ago with McAfee VirusScan 8 and 6004 errors - I'm running the latest McAfee Security Centre on this PC. I've tried disabling the realtime file scanning but this made no difference. But as this AV software is also installed on the other machines, it can probably be ruled out as a suspect.

The only thing I can think of is that there are three Ethernet switches between the problem machine and the router/DHCP server - I have yet to try physically moving the PC to the main Ethernet switch to see if this makes any difference.

The topology is as follows:

-Broadband router/DHCP server connected (100 mbps) to gigabit switch 1.
-Gigabit switch 1 onward connects to PCs 1 & 2, wireless router (DHCP disabled) and gigabit switch 2.
-Gigabit switch 2 onward connects to PC 3 and gigabit switch 3.
-Gigabit switch 3 is connected to PC 4 (the one with the error 6004 problem).

As everything works OK, it's not a showstopper - other than the event log entry there are no other symptoms/problems. However, I'd rather not have my event log filled with these (apparently benign) error messages, and I'm keen to know why they're occurring!

Any ideas/suggestions?

Many thanks,

Alan

FYI, you can copy an Event Error like this:
Start> Run> type in eventvwr

Do this on each the System and the Applications logs:
1. Click to open the log>
2. Look for the Error>
3 .Right click on the Error> Properties>
4. Click on Copy button, top right, below the down arrow
5. Paste here (Ctrl V)

It will put the Error in the format below and it will include the Event #m the Source and the Description. Your Error would look like this:
Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6004
Date: Today
Time: Now
User: N/A
Computer: Yours
Description:
A driver packet received from the I/O subsystem was invalid. The data is the packet.

What it means:

One of the drivers used by for Input/Output operations (I/O can be disk or network operations) attempted to communicate with the EventLog service but the data received was not intelligible (invalid, not following the specifications for those type of data packets). The Event Log system is recording this error in the log along with the data received (in case it may provide some clues as to what is causing this problem). The driver is the software that is handling the packets received from one of the I/O systems by receiving them and sending them to the proper application.

Click to expand...

Possible causes: and Resolutions
1. McAfee AV patch
2. Mismatch between the server’s NIC and the switch port. Ensure that the speed and flow control are hard-set on both.
3. The driver is functioning properly but is logging incorrectly formatted packets in the event log.
See TechNet HERE
4. Faulty network card (or network card drivers) - the replacement of the card fixing the issue.

Source: EventID.net

Bobbye said:

FYI, you can copy an Event Error like this:
Start> Run> type in eventvwr

Do this on each the System and the Applications logs:
1. Click to open the log>
2. Look for the Error>
3 .Right click on the Error> Properties>
4. Click on Copy button, top right, below the down arrow
5. Paste here (Ctrl V)

Click to expand...

Thanks for the reply Bobbye. Here's the system event log entry:

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6004
Date: 22/01/2009
Time: 12:53:39
User: N/A
Computer: MEDIAPC
Description:
A driver packet received from the I/O subsystem was invalid. The data is the packet.

For more information, see Help and Support Center at http.//go.microsoft.com/fwlink/events.asp.
Data:
0000: 0c 00 e0 00 0e 00 00 00 ..à.....
0008: e8 d4 3e 72 90 7c c9 01 èÔ>r|É.
0010: 40 00 00 00 00 00 00 00 @.......
0018: 00 00 00 00 04 00 4e 00 ......N.
0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
0028: 00 00 00 00 10 00 00 c0 .......À
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...
0080: 44 00 4f 00 47 00 48 00 D.O.G.H.
0088: 4f 00 55 00 53 00 45 00 O.U.S.E.
0090: 00 00 4e 00 65 00 74 00 ..N.e.t.
0098: 42 00 54 00 5f 00 54 00 B.T._.T.
00a0: 63 00 70 00 69 00 70 00 c.p.i.p.
00a8: 5f 00 7b 00 37 00 35 00 _.{.7.5.
00b0: 36 00 39 00 37 00 43 00 6.9.7.C.
00b8: 44 00 42 00 2d 00 33 00 D.B.-.3.
00c0: 39 00 38 00 36 00 2d 00 9.8.6.-.
00c8: 34 00 37 00 37 00 37 00 4.7.7.7.
00d0: 2d 00 41 00 37 00 36 00 -.A.7.6.
00d8: 41 00 2d 00 46 00 00 00 A.-.F...

No error gets written to the application event log.

Since posting, I tried plugging the LAN cable from switch 2 directly into the problem PC (MEDIAPC) - thus bypassing switch 3. The error is still produced.

It's odd that this only happens when I browse the shared folders across the network in Windows Explorer - loading files in applications is OK. The only other thing that comes to mind is that I have the "Link Shell Extension" add-on installed in WIndows Explorer on this machine, which provides Vista-like hardlink and junction functionality in XP. However, this is also installed on the file server, which does not produce these event log errors.

I've just noticed that I also get these occasional 4226 warning messages in the system event log:

Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 03/12/2008
Time: 19:23:10
User: N/A
Computer: MEDIAPC
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http.//go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I do have 14 network folders mapped as network drives in Explorer on this machine. There doesn't seem to be a correlation between this warning and the 6004 errors in the log though. Could there be a connection though?

Thanks again.