Okay, here's where we're at now:
Read up on Kernel Extensions, or kexts.
Watched a video or two on kexts.
Marrying info I gathered from all resources, in Terminal, ran
echo "Team ID,Bundle Identifier,KEXT Allowed,Developer Name,Flags"> ~/Desktop/kext.csv
sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy "SELECT * FROM kext_policy;" | sed 's/|/,/g' >> ~/Desktop/kext.csv
open ~/Desktop/kext.csv
Team ID Bundle Identifier KEXT Allowed Developer Name Flags
RR43DU5BN9 com.protech.NoSleep 1 Pavel Prokofiev 8
QX5T8D6EDU com.bluestacks.kext.Hypervisor 1 BlueStack Systems Inc. 8
3T5GSNBU6W com.boxcryptor.BCFS.filesystems.bcfs 1 Benjamin Fleischer 8
6HB5Y2QTA3 com.hp.kext.io.enabler.compound 1 HP Inc. 0
6Q6RVXVYC2 com.webroot.driver.WebrootSecureAnywhere 0 Webroot Software Inc. 4
4/5 of these can go. Boxcryptor is the only one I'd want to keep around but I can even rebuild everything if need be. Webroot I installed for 1 hour before removing it, bluestacks shouldn't be on here at all, hp printers were removed quite some time ago. IT could be the NoSleep that is the problem as I believe it had stopped by MB from sleeping and it ran completely out of power. Got a 'kernal panic' went I finally got it going, this was 4-8 weeks ago. Next I ran the following to find the non-apple kexts and got back.
kextstat | grep -v com.apple
Index Refs Address Size Wired Name (Version) UUID <Linked Against>
143 0 0xffffff7f83971000 0x4000 0x4000 com.protech.NoSleep (1.4.0) 79207772-D7BF-34EE-B7B6-6E90A96D8062 <6 5 3>
159 0 0xffffff7f83c9c000 0x17000 0x17000 com.boxcryptor.BCFS.filesystems.bcfs (3.10.4) 70019C97-2135-3E55-A67B-EED2E21A4933 <8 6 5
and running
kextfind -loaded -not -b -s com.apple
/Library/Extensions/NoSleep.kext
At this point I restarted and went into recovery mode, Terminal, did a 'rm -rf NoSleep.kext' and then sniffed through as many folders as I could think of clearing out SecureAnywhere.kext, hp_io_enabler_compound.kext (MacHD/Library/StagedExt/Lib/Extensions) as well as in LaunchAgents and LaunchDaemons (I found a protech.plist which is the No Sleep app).
Restarted. I've attached the system.log from that point. Spotlight did not work at all at first but came back within 5-10 minutes.
Interestingly, these commands didn't change the output of the 6x6 table above, but I'm guessing they are looking elsewhere.
echo "Team ID,Bundle Identifier,KEXT Allowed,Developer Name,Flags"> ~/Desktop/kext2.csv
sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy "SELECT * FROM kext_policy;" | sed 's/|/,/g' >> ~/Desktop/kext2.csv
open ~/Desktop/kext2.csv
But this looks better...
Greg~ $kextstat | grep -v com.apple
Index Refs Address Size Wired Name (Version) UUID <Linked Against>
158 0 0xffffff7f83aac000 0x17000 0x17000 com.boxcryptor.BCFS.filesystems.bcfs (3.10.4) 70019C97-2135-3E55-A67B-EED2E21A4933 <8 6 5
I'll let you tell me how the logs look as I can't make any sense of that yet.
What's next coach?? :)
Thanks,
Greg
