XP Network Problem - Eventlog Error 6004

[conrod]

Hi All,

I have a problem which I originally posted here. I received some initial help from Bobbye, who then suggested I post the problem here.

Here's the original problem description.

On my home Windows XP workgroup I have four PCs (wired connections) and two notebooks (wireless connections) - all running XP Pro (SP3). One PC acts as the main file server - for email storage and to serve two Home Theatre PCs for audio/video streaming. I have an ADSL router which acts as the DHCP server for the network.

One of my HTPCs keeps producing 6004 errors in the event log: "A driver packet received from the I/O subsystem was invalid. The data is the packet."

One of these errors (and only one) is generated every time I browse "My Network Places" on this PC in Windows Explorer and click on a shared folder on any of the other machines in the workgroup. Once connected, I can copy files, play audio/video files from that machine with no further errors. All the other machines are OK - i.e. I can browse shared folders on other machines (including the one with the problem) with no errors in the event log.

So this says to me that the problem is related solely to this one machine. This PC has an inbuilt 100 Mbps Nvidia LAN connection (normally disabled in the BIOS) and a gigabit Realtek card. Thinking this might be hardware related, I re-enabled the 100 Mbps connection and hooked that up to the Ethernet switch instead - but the problem remained.

At that time it was mainly an academic exercise - I was just curious as to why I was getting the errors. However, tonight my media player software stuttered and then froze, and the system eventlog showed for of these errors in quick succession. Here they are:

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6004
Date: 27/01/2009
Time: 20:58:54
User: N/A
Computer: MEDIAPC1
Description:
A driver packet received from the I/O subsystem was invalid. The data is the packet.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0c 00 e0 00 0e 00 00 00 ..à.....
0008: c5 00 3f 10 c2 80 c9 01 Å.?.€É.
0010: 40 00 00 00 00 00 00 00 @.......
0018: 00 00 00 00 04 00 4e 00 ......N.
0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
0028: 00 00 00 00 10 00 00 c0 .......À
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...
0080: 44 00 4f 00 47 00 48 00 D.O.G.H.
0088: 4f 00 55 00 53 00 45 00 O.U.S.E.
0090: 00 00 4e 00 65 00 74 00 ..N.e.t.
0098: 42 00 54 00 5f 00 54 00 B.T._.T.
00a0: 63 00 70 00 69 00 70 00 c.p.i.p.
00a8: 5f 00 7b 00 37 00 35 00 _.{.7.5.
00b0: 36 00 39 00 37 00 43 00 6.9.7.C.
00b8: 44 00 42 00 2d 00 33 00 D.B.-.3.
00c0: 39 00 38 00 36 00 2d 00 9.8.6.-.
00c8: 34 00 37 00 37 00 37 00 4.7.7.7.
00d0: 2d 00 41 00 37 00 36 00 -.A.7.6.
00d8: 41 00 2d 00 46 00 00 00 A.-.F...

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6004
Date: 27/01/2009
Time: 20:58:53
User: N/A
Computer: MEDIAPC1
Description:
A driver packet received from the I/O subsystem was invalid. The data is the packet.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0c 00 e0 00 0e 00 00 00 ..à.....
0008: d9 9f 1d 10 c2 80 c9 01 ÙŸ..€É.
0010: 40 00 00 00 00 00 00 00 @.......
0018: 00 00 00 00 04 00 4e 00 ......N.
0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
0028: 00 00 00 00 10 00 00 c0 .......À
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...
0080: 44 00 4f 00 47 00 48 00 D.O.G.H.
0088: 4f 00 55 00 53 00 45 00 O.U.S.E.
0090: 00 00 4e 00 65 00 74 00 ..N.e.t.
0098: 42 00 54 00 5f 00 54 00 B.T._.T.
00a0: 63 00 70 00 69 00 70 00 c.p.i.p.
00a8: 5f 00 7b 00 37 00 35 00 _.{.7.5.
00b0: 36 00 39 00 37 00 43 00 6.9.7.C.
00b8: 44 00 42 00 2d 00 33 00 D.B.-.3.
00c0: 39 00 38 00 36 00 2d 00 9.8.6.-.
00c8: 34 00 37 00 37 00 37 00 4.7.7.7.
00d0: 2d 00 41 00 37 00 36 00 -.A.7.6.
00d8: 41 00 2d 00 46 00 00 00 A.-.F...

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6004
Date: 27/01/2009
Time: 20:58:51
User: N/A
Computer: MEDIAPC1
Description:
A driver packet received from the I/O subsystem was invalid. The data is the packet.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0c 00 e0 00 0e 00 00 00 ..à.....
0008: 8d 37 f1 0e c2 80 c9 01 7ñ.€É.
0010: 40 00 00 00 00 00 00 00 @.......
0018: 00 00 00 00 04 00 4e 00 ......N.
0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
0028: 00 00 00 00 10 00 00 c0 .......À
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...
0080: 44 00 4f 00 47 00 48 00 D.O.G.H.
0088: 4f 00 55 00 53 00 45 00 O.U.S.E.
0090: 00 00 4e 00 65 00 74 00 ..N.e.t.
0098: 42 00 54 00 5f 00 54 00 B.T._.T.
00a0: 63 00 70 00 69 00 70 00 c.p.i.p.
00a8: 5f 00 7b 00 37 00 35 00 _.{.7.5.
00b0: 36 00 39 00 37 00 43 00 6.9.7.C.
00b8: 44 00 42 00 2d 00 33 00 D.B.-.3.
00c0: 39 00 38 00 36 00 2d 00 9.8.6.-.
00c8: 34 00 37 00 37 00 37 00 4.7.7.7.
00d0: 2d 00 41 00 37 00 36 00 -.A.7.6.
00d8: 41 00 2d 00 46 00 00 00 A.-.F...

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6004
Date: 27/01/2009
Time: 20:58:51
User: N/A
Computer: MEDIAPC1
Description:
A driver packet received from the I/O subsystem was invalid. The data is the packet.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0c 00 e0 00 0e 00 00 00 ..à.....
0008: a1 d6 cf 0e c2 80 c9 01 ¡ÖÏ.€É.
0010: 40 00 00 00 00 00 00 00 @.......
0018: 00 00 00 00 04 00 4e 00 ......N.
0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
0028: 00 00 00 00 10 00 00 c0 .......À
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...
0080: 44 00 4f 00 47 00 48 00 D.O.G.H.
0088: 4f 00 55 00 53 00 45 00 O.U.S.E.
0090: 00 00 4e 00 65 00 74 00 ..N.e.t.
0098: 42 00 54 00 5f 00 54 00 B.T._.T.
00a0: 63 00 70 00 69 00 70 00 c.p.i.p.
00a8: 5f 00 7b 00 37 00 35 00 _.{.7.5.
00b0: 36 00 39 00 37 00 43 00 6.9.7.C.
00b8: 44 00 42 00 2d 00 33 00 D.B.-.3.
00c0: 39 00 38 00 36 00 2d 00 9.8.6.-.
00c8: 34 00 37 00 37 00 37 00 4.7.7.7.
00d0: 2d 00 41 00 37 00 36 00 -.A.7.6.
00d8: 41 00 2d 00 46 00 00 00 A.-.F...

So the error is now causing real problems! I've uninstalled McAfee Security Center, which made no difference. I've also updated the LAN card driver to the latest version - again no difference.

Any advice guys?

Thanks in advance.

 

[DelJo63]

0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...

which is
M.R.x.S..m.b..D.e.v.i.c.e.\.L.a.n.m.a.n.R.e.d.r.e.c.t.o.r

from other sources, see

Invalid LAA Media Access Control Address Causes Network Driver Failure
Q171332

​

 

[conrod]

0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...

which is
M.R.x.S..m.b..D.e.v.i.c.e.\.L.a.n.m.a.n.R.e.d.r.e.c.t.o.r

from other sources, see

Invalid LAA Media Access Control Address Causes Network Driver Failure
Q171332

​

Hi Jobeard,

Thanks for your reply. I typed "ipconfig /all" in a DOS window, and the Gigabit NIC MAC address was reported as 00-1A-EE-01-00-27, which looks OK to me. I had also previously tried re-enabling the onboard 100Mbps NIC which made no difference, so this suggests the MAC address isn't an issue.

I've performed some further diagnostics today, as follows.

1) I tried booting in safe mode, with networking - same problem.

2) I hooked another Win XP Pro SP3 PC up to this machine's LAN cable - no 6004 errors. So it's definitely something with this PC rather than a network/cabling issue.

3) The file server runs various backup tasks under the control of the Task Scheduler. In order for this to work, I had to set a password on the main user account on that (FILESERVER) machine, whereas all the other PCs in the workgroup have blank passwords. I deleted that password, and now I have an interesting development.

Instead of error 6004 when I access a shared folder on FILESERVER from MEDIAPC1 I now get a 3019 warning:

Event Type: Warning
Event Source: MRxSmb
Event Category: None
Event ID: 3019
Date: 28/01/2009
Time: 19:50:03
User: N/A
Computer: MEDIAPC1
Description:
The redirector failed to determine the connection type.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 04 00 4e 00 ......N.
0008: 00 00 00 00 cb 0b 00 80 ....Ë..€
0010: 00 00 00 00 10 00 00 c0 .......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I had noticed this behaviour earlier today when I tried accessing shared files on two other machines that had just been turned on - a wired PC and a wireless notebook. For the former, the 3019 warnings eventually gave way to 6004 errors. But for the notebook, the 3019s seen to be permanent. I'm guessing this has something to do with it being a wireless connection?

Again, the explanations on the Microsoft site don't seem to relate to my problem at all. All very frustrating!

 

[DelJo63]

you can not access file shares with blank passwords.

 

[conrod]

you can not access file shares with blank passwords.

Hi Jobeard.

Your reply has thrown me a bit!

Until the need arose to use the Task Scheduler on the file server machine, I've always had blank passwords on the PC user accounts, and have been successfully sharing files across the network for years. However, all machines have the same account name (and blank password), and it's a workgroup rather than a domain, so this may be why!

I also discovered yesterday that the need for a scheduled task to be run in an account with a password can be removed by disabling "Limit local account use of blank passwords to console logon only" in Local Security Settings.

As an update, after a while, the 3019 warnings were replaced by the 6004 errors again, so I'm back where I started! I'm toying with the idea with making a new build on another HDD to see if the problem is there on a clean build.

Thanks again for your replies.

 

[DelJo63]

>>However, all machines have the same account name (and blank password), and it's a workgroup rather than a domain, so this may be why!

YES Make sure you enable Simple Sharing and the above will work

 

[conrod]

Solved.

Problem solved!

I performed a clean install of Windows and all the other software on the problem PC, as a result of which the 6004 errors disappeared from the system eventlog. So this must have been a driver or other software problem. Strange, as I have reinstalled all the previously installed software!

However, I still suffered further hangs when streaming video files - so this had to be a separate problem. They turned out to be caused by a faulty D-Link ethernet switch. Having had a D-Link router fail a year or so ago, this does not seem to be a particularly reliable brand - I've never had any problems with my Netgear routers and switches.

Since removing the offending switch, I've had no further problems. It would have been nice to discover the actual cause of the 6004 errors, but they seem to have been innocuous after all anyway.

Thanks for the help guys - hopefully this may prove useful to someone else hitting the problem and Googling for an answer in the future!

 

[LookinAround]

I believe the ability to access file shares remotely with/without a password is controlled by how one sets Security policy Accounts: Limit local account use of blank passwords.

I haven't double checked but if memory is correct,the policy is the controlling factor. You can modify policy and modify behavior over a domain as well.