EventID: error 6004

Discussion in 'ESET Smart Security' started by Jeccu, Jun 29, 2008.

Thread Status:
Not open for further replies.
  1. Jeccu

    Jeccu Registered Member

    Joined:
    Oct 20, 2004
    Posts:
    37
    Location:
    Finland
    I'm having these errors on my XP (SP3) Event Log when browsing my network drives:

    EventLog Error 6004
    "A driver packet received from the I/O subsystem was invalid. The data is the packet."

    0000: 0c 00 e0 00 0e 00 00 00 ..à.....
    0008: 72 e8 fd 88 d9 d9 c8 01 rèýˆÙÙÈ.
    0010: 40 00 00 00 00 00 00 00 @.......
    0018: 00 00 00 00 04 00 4e 00 ......N.
    0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
    0028: 00 00 00 00 10 00 00 c0 .......À
    0030: 00 00 00 00 00 00 00 00 ........
    0038: 00 00 00 00 00 00 00 00 ........
    0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
    0048: 6d 00 62 00 00 00 5c 00 m.b...\.
    0050: 44 00 65 00 76 00 69 00 D.e.v.i.
    0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
    0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
    0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
    0070: 69 00 72 00 65 00 63 00 i.r.e.c.
    0078: 74 00 6f 00 72 00 00 00 t.o.r...
    0080: 4b 00 4f 00 54 00 49 00 K.O.T.I.
    0088: 56 00 45 00 52 00 4b 00 V.E.R.K.
    0090: 4b 00 4f 00 00 00 4e 00 K.O...N.
    0098: 65 00 74 00 42 00 54 00 e.t.B.T.
    00a0: 5f 00 54 00 63 00 70 00 _.T.c.p.
    00a8: 69 00 70 00 5f 00 7b 00 i.p._.{.
    00b0: 32 00 42 00 35 00 43 00 2.B.5.C.
    00b8: 31 00 32 00 31 00 35 00 1.2.1.5.
    00c0: 2d 00 35 00 39 00 38 00 -.5.9.8.
    00c8: 41 00 2d 00 34 00 45 00 A.-.4.E.
    00d0: 39 00 32 00 2d 00 41 00 9.2.-.A.
    00d8: 30 00 46 00 30 00 00 00 0.F.0...

    I thought this had been fixed already?
    https://www.wilderssecurity.com/showthread.php?t=198897

    I'm running latest Eset Smart Security 3.0.667 (Windows XP Home SP3) and getting these errors every time I browse my network drive. Though, everything seems to work ok...? When I unistall ESS, errors are gone. I've tried multiple times to uninstall ESS and then clear install. As soon as Eset is installed, I'll start to get those errors to my Event Log.

    Anyone else still having these errors?
    Any suggestions?
     
  2. denno

    denno Registered Member

    Joined:
    Mar 22, 2006
    Posts:
    49
    I'm using .657 on XP SP3 (fresh) and see the error too, although I haven't tested to see what causes it to show up in event viewer. However, I haven't seen any user-visible problems.
     
  3. Jeccu

    Jeccu Registered Member

    Joined:
    Oct 20, 2004
    Posts:
    37
    Location:
    Finland
    Well, in my case it has deffinitely something to do with ESS, because like I said, when I uninstall ESS I won't get any more these errors to my Event Log.

    Most of the time that I access a network share, either browsing a folder or opening a file, I get this error 6004. But somethimes (very rarely) I only get a
    warning below instead. This is caused by a same thing and it's related --> no more these warnings either when ESS is uninstalled (disabling won't help).

    Event Type: Warning
    Event Source: MRxSmb
    Event Category: None
    Event ID: 3019
    Description: The redirector failed to determine the connection type.

    When I googled about this issue, turned out that this error has something to do with some driver and found that link I wrote above. It was confirmed that earlier builds of ESS had this issue but it should be fixed by now? But, I still have this problem with my ESS 3.0.667.

    Are we the only ones? Can somebody else confirm this also?
    Maybe ESS + XP SP3?
     
  4. dbrisendine

    dbrisendine Registered Member

    Joined:
    Jul 15, 2006
    Posts:
    51
    Location:
    BC, Canada
    Have seen the same listing in my event log but without the network drive error just the MRxSmb message. Also, this is usually when vpn'ing to my companies network. To browse the network servers (with 667) I have to disable the firewall in ESS. I have noticed a message in the log files (of ESS) that AMON has release file: portloop. Maybe this will help track down the problem.
     
  5. simons101

    simons101 Registered Member

    Joined:
    Jun 14, 2008
    Posts:
    4
    try setting your network card from auto negotiate to a fixed 10/100/1000 full/half setting
     
  6. mayt

    mayt Eset Staff Account

    Joined:
    Mar 12, 2007
    Posts:
    84
    Location:
    Bratislava
    Hello, does it eventually help when you try to disable network drives scanning in Resident protection ThreatSense settings?
     
  7. sliding

    sliding Registered Member

    Joined:
    Aug 13, 2008
    Posts:
    3
    I am also experiencing this problem, I have 3.0.669 on xp sp2. Is there a way to disable ess from writing to the event log?
     
  8. sliding

    sliding Registered Member

    Joined:
    Aug 13, 2008
    Posts:
    3
    Mayt

    Disabling network drives scanning in Resident protection ThreatSense does not make the 6004 error disappear. Do you have any other suggestions?

    Are there others still experiencing this issue?

    Thanks in advance.
     
  9. probedb

    probedb Registered Member

    Joined:
    Sep 27, 2008
    Posts:
    32
    Location:
    Sheffield, UK
    I'm also getting this when accessing network drives using ESS.

    Anyone had any new thoughts on this?

    On XP Pro SP3 with 3.0.672.0 card has the latest Marvell drivers and is set to Full Duplex 1000Mbps.
     
  10. DesertRat

    DesertRat Registered Member

    Joined:
    Jul 12, 2008
    Posts:
    32
    For what it's worth, I've seen both those errors (EventLog 6003 and MRxSmb 3019) many times on machines NOT running Eset products. Almost always, it's an error message that you can safely ignore. If it occurs, again, it's usually only the FIRST access to the remote file. The circumstances where I've seen it most frequently are in a network environment when drive mapping to a share on another computer, and then, additionally, browsing the share using procedures such as "View Workgroup Computers".

    The replies about updating network interface card drivers is also a good one, as is the the reply about manually specifying the speed of the interface.

    But really, if I checked a computer and found that error, then other than updating the NIC driver, I wouldn't do anything. I wouldn't even bother manually setting the interface speed.
     
  11. MidSpeck

    MidSpeck Registered Member

    Joined:
    Apr 24, 2007
    Posts:
    30
  12. doktornotor

    doktornotor Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2,047
    Completely unrelated to ESS... See Q315244.
     
  13. MidSpeck

    MidSpeck Registered Member

    Joined:
    Apr 24, 2007
    Posts:
    30
    I disagree that this is completely unrelated. Many people (including myself) do not see this warning at all until after installing ESET products. While the effect may be NetBT querying the loopback adapter, it seems to be caused by ESET injecting itself into the TCP/IP stack and then transferring large amounts of data.

    I can even disable NetBIOS over TCP/IP in the network adapter properties and will still see this warning.
     
  14. doktornotor

    doktornotor Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2,047
    Well I see it all the time, NOD32 or not... exactly as described in the MS document. Frankly I have better thing to do than pondering system logs about totally harmless warning MS hasn't cared to fix for ages. :rolleyes:
     
  15. MidSpeck

    MidSpeck Registered Member

    Joined:
    Apr 24, 2007
    Posts:
    30
    Understood. If it doesn't affect what you do, it's not really a problem. It does affect me though because it slows my work down about 10 fold when this warning pops its head.

    Most of the time, I can copy 10,000 small files from my computer to a server without issue... taking just a few minutes. However, if I install NOD32 on the client and try the same operation, it can take a few hours.

    At first I thought it was because NOD32 needed to scan each of the files first, but it's actually related to the MrxSmb warning... because I don't always get that event -- and the copy is only slow when it appears and it never appears with NOD32 uninstalled. So there must be some networking overhead with each of those small files when that warning appears -- large files copy fast because a 1 second overhead is negligible compared to the copying of the file... 10,000 small files though makes a big difference if you have to wait 1 second before it copies each one.

    Again, I understand this is an issue that most people wouldn't even notice -- but it does exist if you are seeing the 3019 warning.
     
  16. MidSpeck

    MidSpeck Registered Member

    Joined:
    Apr 24, 2007
    Posts:
    30
    I'm going to rescind some of my statement above. I've spent several hours today really digging into this with Wireshark. MrxSmb warning 3019 does not seem to be actual culprit as doktornotor mentioned, even though it does show up.

    As a followup, what I am seeing is actually described in KB 321098. I haven't tried their resolution yet to see how it works with NOD32, but hopefully it helps speed things up.

    Just thought that I wouldn't leave this hanging.
     
  17. goran_larsson

    goran_larsson Registered Member

    Joined:
    Jan 25, 2008
    Posts:
    51
    Location:
    Stockholm, Sweden
    Unchecking network drives seems to have little or no effetc just like in v3 when this was encountered the first time I saw it.

    /Goran
     
Thread Status:
Not open for further replies.