EventID: error 6004

I'm having these errors on my XP (SP3) Event Log when browsing my network drives:

EventLog Error 6004
"A driver packet received from the I/O subsystem was invalid. The data is the packet."

0000: 0c 00 e0 00 0e 00 00 00 ..à.....
0008: 72 e8 fd 88 d9 d9 c8 01 rèýˆÙÙÈ.
0010: 40 00 00 00 00 00 00 00 @.......
0018: 00 00 00 00 04 00 4e 00 ......N.
0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
0028: 00 00 00 00 10 00 00 c0 .......À
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...
0080: 4b 00 4f 00 54 00 49 00 K.O.T.I.
0088: 56 00 45 00 52 00 4b 00 V.E.R.K.
0090: 4b 00 4f 00 00 00 4e 00 K.O...N.
0098: 65 00 74 00 42 00 54 00 e.t.B.T.
00a0: 5f 00 54 00 63 00 70 00 _.T.c.p.
00a8: 69 00 70 00 5f 00 7b 00 i.p._.{.
00b0: 32 00 42 00 35 00 43 00 2.B.5.C.
00b8: 31 00 32 00 31 00 35 00 1.2.1.5.
00c0: 2d 00 35 00 39 00 38 00 -.5.9.8.
00c8: 41 00 2d 00 34 00 45 00 A.-.4.E.
00d0: 39 00 32 00 2d 00 41 00 9.2.-.A.
00d8: 30 00 46 00 30 00 00 00 0.F.0...

I thought this had been fixed already?
https://www.wilderssecurity.com/showthread.php?t=198897

I'm running latest Eset Smart Security 3.0.667 (Windows XP Home SP3) and getting these errors every time I browse my network drive. Though, everything seems to work ok...? When I unistall ESS, errors are gone. I've tried multiple times to uninstall ESS and then clear install. As soon as Eset is installed, I'll start to get those errors to my Event Log.

Anyone else still having these errors?
Any suggestions?

 

I'm using .657 on XP SP3 (fresh) and see the error too, although I haven't tested to see what causes it to show up in event viewer. However, I haven't seen any user-visible problems.

 

Well, in my case it has deffinitely something to do with ESS, because like I said, when I uninstall ESS I won't get any more these errors to my Event Log.

Most of the time that I access a network share, either browsing a folder or opening a file, I get this error 6004. But somethimes (very rarely) I only get a
warning below instead. This is caused by a same thing and it's related --> no more these warnings either when ESS is uninstalled (disabling won't help).

Event Type: Warning
Event Source: MRxSmb
Event Category: None
Event ID: 3019
Description: The redirector failed to determine the connection type.

When I googled about this issue, turned out that this error has something to do with some driver and found that link I wrote above. It was confirmed that earlier builds of ESS had this issue but it should be fixed by now? But, I still have this problem with my ESS 3.0.667.

Are we the only ones? Can somebody else confirm this also?
Maybe ESS + XP SP3?

 

Have seen the same listing in my event log but without the network drive error just the MRxSmb message. Also, this is usually when vpn'ing to my companies network. To browse the network servers (with 667) I have to disable the firewall in ESS. I have noticed a message in the log files (of ESS) that AMON has release file: portloop. Maybe this will help track down the problem.

 

try setting your network card from auto negotiate to a fixed 10/100/1000 full/half setting

 

Hello, does it eventually help when you try to disable network drives scanning in Resident protection ThreatSense settings?

 

I am also experiencing this problem, I have 3.0.669 on xp sp2. Is there a way to disable ess from writing to the event log?

 

Mayt

Disabling network drives scanning in Resident protection ThreatSense does not make the 6004 error disappear. Do you have any other suggestions?

Are there others still experiencing this issue?

Thanks in advance.

 

I'm also getting this when accessing network drives using ESS.

Anyone had any new thoughts on this?

On XP Pro SP3 with 3.0.672.0 card has the latest Marvell drivers and is set to Full Duplex 1000Mbps.

 

For what it's worth, I've seen both those errors (EventLog 6003 and MRxSmb 3019) many times on machines NOT running Eset products. Almost always, it's an error message that you can safely ignore. If it occurs, again, it's usually only the FIRST access to the remote file. The circumstances where I've seen it most frequently are in a network environment when drive mapping to a share on another computer, and then, additionally, browsing the share using procedures such as "View Workgroup Computers".

The replies about updating network interface card drivers is also a good one, as is the the reply about manually specifying the speed of the interface.

But really, if I checked a computer and found that error, then other than updating the NIC driver, I wouldn't do anything. I wouldn't even bother manually setting the interface speed.

 

Re: 3019 MrxSmb

Just for reference: Discussion of 3019 MrxSmb warning

 

Completely unrelated to ESS... See Q315244.

 

I disagree that this is completely unrelated. Many people (including myself) do not see this warning at all until after installing ESET products. While the effect may be NetBT querying the loopback adapter, it seems to be caused by ESET injecting itself into the TCP/IP stack and then transferring large amounts of data.

I can even disable NetBIOS over TCP/IP in the network adapter properties and will still see this warning.

 

Well I see it all the time, NOD32 or not... exactly as described in the MS document. Frankly I have better thing to do than pondering system logs about totally harmless warning MS hasn't cared to fix for ages.

 

Understood. If it doesn't affect what you do, it's not really a problem. It does affect me though because it slows my work down about 10 fold when this warning pops its head.

Most of the time, I can copy 10,000 small files from my computer to a server without issue... taking just a few minutes. However, if I install NOD32 on the client and try the same operation, it can take a few hours.

At first I thought it was because NOD32 needed to scan each of the files first, but it's actually related to the MrxSmb warning... because I don't always get that event -- and the copy is only slow when it appears and it never appears with NOD32 uninstalled. So there must be some networking overhead with each of those small files when that warning appears -- large files copy fast because a 1 second overhead is negligible compared to the copying of the file... 10,000 small files though makes a big difference if you have to wait 1 second before it copies each one.

Again, I understand this is an issue that most people wouldn't even notice -- but it does exist if you are seeing the 3019 warning.

 

I'm going to rescind some of my statement above. I've spent several hours today really digging into this with Wireshark. MrxSmb warning 3019 does not seem to be actual culprit as doktornotor mentioned, even though it does show up.

As a followup, what I am seeing is actually described in KB 321098. I haven't tried their resolution yet to see how it works with NOD32, but hopefully it helps speed things up.

Just thought that I wouldn't leave this hanging.

 

Unchecking network drives seems to have little or no effetc just like in v3 when this was encountered the first time I saw it.

/Goran