My recent Crash Report investigation - further help requested.

Question

Level 1

24 points

My recent Crash Report investigation - further help requested.

A very helpful responder here called 'Mac Jim ID' recently said this to me:-

"Unfortunately Crash Reports are not very useful in diagnosing a problem. The only thing that can be gained from the Crash Report is that a pointer to memory in your Kernel used by EtreCheck no longer points to a valid address.

What the Crash Report does not tell you is why it is no longer valid. Another process running on your computer may have changed the Kernel and the crash report will not tell you what that process was. System Extensions are the first place to look for the actual problem, since they have direct access to the Kernel and are allowed to make those changes."

Can anyone tell me how to locate the System Extension which may contain relevant information?

In case it is helpful, here is a copy of the Crash Report for examination:-

Crash Report - EtreCheckPro 2024-06-15

Thank you.

iMac (2017 – 2020)

Posted on Jun 18, 2024 12:13 AM

Reply

Answer 1

Best reply

PRP_53

Level 10

86,587 points

Jun 18, 2024 5:28 AM in response to TTWO_Always

From your Etrecheck Report

" Kaspersky "

System Extensions:

[Running] Kaspersky System Extension - version 25.0.0.12 (Kaspersky Lab Switzerland GmbH - 2024-04-09)

Application: /Applications/Kaspersky Anti-Virus For Mac.app - version 25.0.0.12 (Kaspersky Lab Switzerland GmbH - 2024-06-15)

Description: Kaspersky System Extension monitors real-time file activity, processes attempting to run and network activity to protect user from malicious web resources and network attacks

Useless and un-needed

Remove as per Developers Instructions

Even at that, it maybe suggested to Start Over from Scratch

This time do not migrate from a Previous Time Machine backup.

It may re-introduce the existing issue back into the computer

Third Party Security Software

Kaspersky Internet Security

Reply

Answer 2

PRP_53

Level 10

86,587 points

Jun 18, 2024 8:27 AM in response to TTWO_Always

Let us through in a previous Missed ( by Bad )

" Executable: ~/Library/Application Support/CleanMyMac X/CleanMyMac X Updater.app/Contents/MacOS/CleanMyMac X Updater "

Disk Cleaner

This will include CleanMyMac , aka “ BrickMyMac “

The Moniker " BrickMyMac " was first Coined by my Colleague @Barney15-E.

It speaks volumes as to what this application can do and has done.

Reply

Answer 3

PRP_53

Level 10

86,587 points

Jun 18, 2024 8:20 AM in response to TTWO_Always

TTWO_Always wrote:

Thanks, PRP_53

I'm going to erase my hard drive(s) and start over soon. But what is this?

disk3 - Apple Disk Image 281 MB ()

External Virtual Interface

disk3s1 - C**********X (Mac OS Extended) 281 MB (274 MB used)

=

Any idea?

If, as you have written " I'm going to erase my hard drive(s) and start over soon. "

To these Old Eyes - Looks like an External Drive

External Virtual Interface

disk3s1 - C**********X (Mac OS Extended) 281 MB (274 MB used)

disk3s1 - C**********X

Filesystem: Mac OS Extended

Disk Image

Mount point: /Volumes/C**********X

Owners enabled: No

Read-only: Yes

Used: 274 MB

Size: 281 MB

Free: 7 MB

Reply

Answer 4

TTWO_Always Author

Level 1

24 points

Jun 18, 2024 9:28 AM in response to PRP_53

PRP_53 wrote:

TTWO_Always wrote:

Thanks, PRP_53

I'm going to erase my hard drive(s) and start over soon. But what is this?

disk3 - Apple Disk Image 281 MB ()

External Virtual Interface

disk3s1 - C**********X (Mac OS Extended) 281 MB (274 MB used)

=

Any idea?

If, as you have written " I'm going to erase my hard drive(s) and start over soon. "

To these Old Eyes - Looks like an External Drive

External Virtual Interface

disk3s1 - C**********X (Mac OS Extended) 281 MB (274 MB used)

disk3s1 - C**********X

Filesystem: Mac OS Extended

Disk Image

Mount point: /Volumes/C**********X

Owners enabled: No

Read-only: Yes

Used: 274 MB

Size: 281 MB

Free: 7 MB

To my old eyes too 😃 ........ but I don't HAVE an External Drive connected to my computer!

Something VERY odd.

I've now uninstalled 'CleanMyMac' - that might make a difference!

I'll run another EtreCheck report and see if it's still there!

Wow! It appears to have dissappeared!

EtreCheck report - after removing CleanMyMac

I'm happy to have discovered the reason!

Thanks for helping. 🙂

Reply

Answer 5

John Galt

Level 10

142,662 points

Jun 19, 2024 3:07 PM in response to TTWO_Always

Are you aware that "Kaspersky" remains installed?

Your Mac will never run properly with it installed. Rule 1 of Macs is don't install junk.

Reply

Answer 6

John Galt

Level 10

142,662 points

Jun 19, 2024 4:29 PM in response to TTWO_Always

You don't have to demonstrate anything to me. It's your Mac. If it is working to your satisfaction then you're done.

Reply

Answer 7

John Galt

Level 10

142,662 points

Jun 19, 2024 4:07 PM in response to TTWO_Always

TTWO_Always wrote:

Hello John

What on earth makes you think that Kaspersky is still installed on my iMac?

The most recent EtreCheck report you posted indicates its continued presence. Confirm its absence or post an updated one.

Reply

Answer 8

TTWO_Always Author

Level 1

24 points

Jun 18, 2024 3:06 AM in response to TTWO_Always

Hello 😃

Can anyone, please, identify ......

disk3 - Apple Disk Image 281 MB ()

External Virtual Interface

disk3s1 - C**********X (Mac OS Extended) 281 MB (274 MB used)

=

This was found in another EtreCheck report which I ran this morning. I've never seen same before.

As far as I am aware, I don't have such an External interface! What is it and where has it come from?!!

EtreCheck Report 18 June 2024

Interestingly, there's no mention of the EtreCheck Crash which occurred recently!

About the EtreSoft Crash!

Thanks for reviewing. 🙂

Reply

Answer 9

Barney-15E

Level 10

113,584 points

Jun 18, 2024 3:45 AM in response to TTWO_Always

if multiple apps are crashing, it may be a RAM problem. Run Apple Diagnostics.

Unless you get a kernel panic, nothing will point to what System Extension is the cause (if it is). Even then, it may not have any direct evidence. If you have any third-party kernel extensions installed, uninstall them following the developer’s instructions.

Reply

Answer 10

TTWO_Always Author

Level 1

24 points

Jun 19, 2024 2:47 PM in response to Barney-15E

Hello again, 'Barney-15E'

You might be mildly interested to learn that I used Terminal to create a Fusion Drive again.

How to fix a split Fusion Drive – Apple Support (UK)

The procedure permanently deletes all data stored on the drives that make up one's Fusion Drive. I then installed MacOS Ventura and then set up my iMac as if it was a brand new machine. I have not used Migration Assistant on this occasion.

Everything appears to be working satisfactorily. Is there another diagnostic facility, apart from EtreCheck, which I can use to show you the current status quo of this computer?

I have cancelled my 'Trial' subscription to Kaspersky and will steer clear of 'CleanMyMac'.

I appreciate the help of you and others here on the ASC forums.

Thank you. 🙂

Reply

Answer 11

TTWO_Always Author

Level 1

24 points

Jun 19, 2024 4:00 PM in response to John Galt

Hello John

What on earth makes you think that Kaspersky is still installed on my iMac?

"You might be mildly interested to learn that I used Terminal to create a Fusion Drive again.

How to fix a split Fusion Drive – Apple Support (UK)

The procedure permanently deletes all data stored on the drives that make up one's Fusion Drive. I then installed MacOS Ventura and then set up my iMac as if it was a brand new machine."

Reply