event id 6004

Discuss Windows Event Log events. What they mean, what they tell you about your machine's security ... and whatever questions else you have.

Moderator: alorbach

event id 6004

Postby blackice » Thu Oct 14, 2004 9:42 am

I have a strange error in event log after i have installed mcafee virus scan 8.1 :

Details
Event Type Windows Event Log
Log Part System
Source EventLog
Event ID 6004
Meaning A driver packet received from the I/O subsystem was invalid. The data is thepacket.
Parameters A driver packet received from the I/O subsystem was invalid. The data is the
packet.
Can someone help me?
blackice
 

Postby therget » Tue Oct 19, 2004 11:55 am

take a look into the following Microsoft Knowledge Base Article :

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q171332 wrote:

SYMPTOMS

If a user types invalid characters other than (0-9 A-F) or types more than 12 characters for the media access control address by not using hyphens between bytes, Windows NT network driver interface specification (NDIS) cannot initialize the card and will result in event message(s):

Event ID: 7000
Source: Service Control Manager
Description: The IBM Token Ring Adapter (ISA/PCMCIA) driver service failed to start due to the following error:

A Device attached to the system is not functioning.
And in some instances, depending on the invalid characters typed, the following event log message may be displayed:

Event ID: 6004
Source: Eventlog
Description: A driver packet received from the I/O subsystem was invalid. The data is the packet

DATA: ........................ibmtok IBMTOK 17


CAUSE

Some network adapter drivers allow an administrator to assign locally administered addresses (LAA) or universally administered addresses (UAA) for the installed adapter card. This allows administrators to manage media access control addresses and use it for inventory control and troubleshooting purposes. The media access control address consists of 6 bytes using HEX Numbers 0-9 and A-F, so a typical media access control address would look like this:
00-C0-4F-C9-F1-70
Most token ring adapter drivers present a dialog box during installation to allow the user to type the LAA media access control address. The field presented to the user allows for 17 characters and assumes the user is going to use hyphens between bytes.

NOTE: Some OEM Ethernet drivers may also support this feature.


RESOLUTION

To resolve this problem, clear the invalid entry by performing the following steps:

1. Click the Start button, point to Settings, click Control Panel, and then double-click the Network icon.

2. Click the Adapters tab, select the installed adapter in question, and then click Properties. When the dialog box appears, verify that the media access control address displayed is valid or clear the entire entry and restart the computer.
The media access control address being used can be displayed from an MS-DOS command prompt by typing:
NET CONFIG WORKSTATION

Workstation active on: NetBT_IBMTOK1 (00C04FC9F170) <--- media access
control address


MORE INFORMATION

It is up to the driver's installation .inf file to parse user input and determine if the values entered are valid during network card installation. Some OEM drivers will prevent invalid entries while other OEM drivers accept any user input, that may cause problems during network card initialization.



Maybe it will help you out :wink:


Regards,
Timm Herget
Adiscon
User avatar
therget
Frequent Poster
 
Posts: 79
Joined: Thu Dec 18, 2003 12:42 pm

Postby blackice » Tue Oct 19, 2004 3:29 pm

I had made that but it's not the resolution; after many tests i have focalized the problem on the mcafee virus scan 8.0i .
The Mcafee have produced 8 patches but nothing resolve the problem.
I have seen on the installation of virus scan that it works on network card.

Thanks however for responding the post
blackice
 

Postby Guest » Wed Nov 10, 2004 5:49 pm

may have to do with specific network cards only. On my machines only dell gx280 machines get this message.
Guest
 

This is an ongoing problem with Mcafee

Postby pm_c1 » Thu Nov 18, 2004 3:07 pm

They seem reluctant to resolve the problem i.e. they are passing the buck to Microsft.

Have a look here (Thanks to Devinem)

http://forums.mcafeehelp.com/viewtopic. ... 648#181648
pm_c1
 

Interesting twist

Postby Razkal » Thu Nov 25, 2004 2:58 pm

Greets, I too am getting the typical 6004 error in my logs. However I just recenetly installed Kaspersky version 5 on my winxp SP2 workstation.

After some reading of other forums, I found something interesting. The error only occured when I clicked on one of my mapped drives. Anytime I tried to access one of my file servers the error shows up in the logs.

Now as I see this is not just a mcafee problem, and can be reproduced using another antivirus program, it is definatley a microsoft problem. I tried that fix above with no success. Lets hope they figure it out soon.

In the meantime everything still works ok, just those annoying errors in the logs.

Razkal
Razkal
 

McAfee Vshield 8 and eventID 6004

Postby piwwa » Sat Nov 27, 2004 11:15 pm

we're having same problem mainly on HP machines running Win XP SP2 or Win2003 - on Citrixservers it slows down performance and cause latency. Still waiting on reaction from MS.
along with eventid 6004 getting a lot of redirector errors.
Mcafee said as a workarround to disable the TDI driver via the registry, this is unsupported but might do the trick. Going too try this asap anyway. Another possible way is downgrade virusscan to version 7.1... didn't have the problem then, didn't have TDI driver either.


Greetz
piwwa
 

Re: event id 6004

Postby Guest » Sat Mar 12, 2005 9:14 am

blackice wrote:I have a strange error in event log after i have installed mcafee virus scan 8.1 :

Details
Event Type Windows Event Log
Log Part System
Source EventLog
Event ID 6004
Meaning A driver packet received from the I/O subsystem was invalid. The data is thepacket.
Parameters A driver packet received from the I/O subsystem was invalid. The data is the
packet.
Can someone help me?
Guest
 

Postby Guest » Tue Apr 26, 2005 5:44 pm

i have the same problems... did anyone find any solutions?

please email me to amarten@amnet.co.cr


thanks
Guest
 

Postby Dax » Fri Apr 29, 2005 8:10 pm

Here is a link i found... hope helps

http://www.nvitc.com/VSE80HF214636.Zip
Dax
 

What a mess this has been

Postby alankitco » Thu Jun 09, 2005 8:43 pm

Until I fund these postings I was going crazy ! Still am !!

So does the hotfix solve the problem once and for all ?

There's been 18,00 posting related to this here.

http://forums.mcafeehelp.com/viewtopic.php?t=34245&postdays=0&postorder=asc&start=10

Alan :cry:
alankitco
New
 
Posts: 1
Joined: Thu Jun 09, 2005 7:01 pm

EventID 6004

Postby DC » Thu Jul 21, 2005 9:55 am

Hi there,
I've found somthing quite interesting with this error.
If you type in manually the same Internal MAC address of your NIC into the 'Locally Administered Address' in the HP Network Configuration Utility and then rebounce the server, the error message disappear.
So perhaps the error is caused by the HP Utilty?

I hope this help a bit

Good Luck

DC
DC
 

EventID 6004

Postby dc1 » Thu Jul 21, 2005 9:59 am

Please ignore my previous message. Carried away by the excitement of thinking to have fixed the problem. In actual fact the error message still appear.

Sorry
dc1
 

Google Ads



Return to Windows Events

Who is online

Users browsing this forum: No registered users and 0 guests

cron