Kernel Panic on Admin User Account

Question

iMac 2.16 GHZ IntelCore 2 Duo with 2GB RAM running OS 10.5.8. After switching from one user account to the Admin User Account the kernel panic message &#x27;You need to restart you computer&#x27; appeared. After holding down the power button and restarting, I tried to login to the same account but got the same error message. Tried again and still same message. I then restarted using the install disk and used Disk Utility to repair the disk. Disk Utility reported missing thread record, incorrect number of threads,invalid volume file count (It should be 823873 instead of 823874) incorrect number of extended attributres and missing directory record and then it continuted to repair the disk and then showed invalid volume file count error again but this time it displayed (It should be 823874 instead of 823873) For some reason the numbers were swapped round from the earlier message. It continued to repair and reported that the Volume Macintosh HD appears to be OK.I restarted the mac and logged into Admin User Account and got the &#x27;You need to restart your computer&#x27; message again. After restarting I logged into the other 3 user accounts and they all work perfectly but each time I log onto the Admin User Account the &#x27;restart computer&#x27; message appears.Is there any way to repair the Admin User Account without having to re-format the hard drive and re-install everything from scratch?

Carolyn Samit · Answer

Try here &gt;  Tutorial: Avoiding and eliminating Kernel panics | MacFixIt - CNETReviews

BDAqua · Answer

Safe Boot from the HD, (holding Shift key down at bootup), login to the admin account, does it still KP?

JanetF · Answer

Thanks Carolyn. I&#x27;ll take some time to work through this to find out if I can work out what is causing the error. Meantime, I used the Disk Utility again and this time used the Verify Permissions option and it came up with all sorts of errors and then finished verifying the permissions. I restarted and this time managed to get into the Admin User Account. I&#x27;m now wary of logging out of the account until I work out what caused the problem.

JanetF · Answer

See my reply to Carolyn  - I didn&#x27;t try Safe Boot and now not sure I want to log out of the Admin Account to try this out. I&#x27;m going to leave the mac on and logged into the account until I can work out what caused the problem.

JanetF · Answer

This problem has gone from bad to worse! Using Safari, the browser crashed (which its been doing regularly for ages) and as usual I had to hard reset the mac as everything just froze. Now when I try to login to the Admin Account the mac just reboots itself. Does this every time I try to login. I can log into the other user accounts but not Admin. I ran Disk Utility and everything reports fine this time. So I tried booting up in Safe Mode and can access the Admin Account.I&#x27;ve not idea what to do next - anyone have any advice on how to fix this? I looked at the logs but they mean nothing to me. There seems to be lots of repeated messages re AppleYukon 2  - here&#x27;s an example01/07/2012 10:06:58 configd[14] AppleTalk shutdown complete01/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - Event scheduler called in Init Level 0 or 101/07/2012 10:06:58 kernel AppleYukon2: error - FATAL: SkGeStopPort() does not terminate (Rx)01/07/2012 10:06:58 kernel AppleYukon2: error - FATAL: SkGeStopPort() does not terminate (Rx)01/07/2012 10:06:58 kernel AppleYukon2: error - Event queued in Init Level 001/07/2012 10:07:00 kernel AppleYukon2: error - Link Partner not Auto-Neg. able01/07/2012 10:07:00 kernel AppleYukon2: error - Link Partner not Auto-Neg. able01/07/2012 10:07:00 configd[14] AppleTalk startup01/07/2012 10:07:00 kernel AppleYukon2: 00000000,00000000 skgehw - cppSkDrvEvent - SK_DRV_LIPA_NOT_AN_ABLE: link partner not auto-negotiate capable, port, phy r601/07/2012 10:07:00 kernel Ethernet [AppleYukon2]: Link up on en0, 10-Megabit, Half-duplex, No flow-control, Debug [796d,0d00,0de1,0200,0021,0000]01/07/2012 10:07:01 mDNSResponder[16] Note: DNS Server 192.168.1.254 for domain . registered more than once01/07/2012 10:07:01 mDNSResponder[16] Note: DNS Server 192.168.1.254 for domain . registered more than once01/07/2012 10:07:02 mDNSResponder[16] Note: DNS Server 192.168.1.254 for domain . registered more than once01/07/2012 10:07:02 mDNSResponder[16] Note: DNS Server 192.168.1.254 for domain . registered more than once01/07/2012 10:07:06 configd[14] AppleTalk startup complete

WZZZ · Answer

After booting in Safe Mode, did you try restarting again to see if it KPs? If it does, post the panic log in full. Open Console in Utilties and navigate to /Library/Logs/PanicReporter.More on KPshttp://www.thexlab.com/faqs/kernelpanics.htmlCheck the RAM with Rember.http://www.kelleycomputing.net/rember/

JanetF · Answer

I&#x27;ve tried restarting and when I login I get as far as the blue desktop and then the machine restarts. I&#x27;ve restarted in Safe Mode and can again access the Admin Account. I&#x27;ve opened PanicReporter but can&#x27;t find a log for 30 June or 1 July. The last date is 27 June and there are 6 logs for that date.I looked in CrashReporter and found a crash report for Safari on 30 June and the first part of the log relates to FlashPlayer. Safari goes slow and crashes on certain websites and I&#x27;m now wondering if it is FlashPlayer that is causing Safari to do this. We have a second iMac which is a couple of years newer and it sometimes hangs when using Safari and I&#x27;ve had to do a hard restart to get out of the problem.Process:         Safari [6413]Path:            /Applications/Safari.app/Contents/MacOS/SafariIdentifier:      com.apple.SafariVersion:         5.0.6 (5533.22.3)Build Info:      WebBrowser-75332203~3Code Type:       X86 (Native)Parent Process:  launchd [255]Date/Time:       2012-06-30 14:00:37.291 +0100OS Version:      Mac OS X 10.5.8 (9L31a)Report Version:  6Anonymous UUID:  C4B612A4-0FA1-472A-8DA2-F93B94B6A4EEException Type:  EXC_BAD_ACCESS (SIGSEGV)Exception Codes: KERN_INVALID_ADDRESS at 0x00000000a603a603Crashed Thread:  0Thread 0 Crashed:0   ???                                     0xa603a603 0 + 27852569631   ...lashPlayer-10.4-10.5.plugin          0x198e4699 0x195f4000 + 30818812   ...lashPlayer-10.4-10.5.plugin          0x198eb60e 0x195f4000 + 31104143   ...lashPlayer-10.4-10.5.plugin          0x1992c1f2 0x195f4000 + 33756024   ...lashPlayer-10.4-10.5.plugin          0x1993e281 0x195f4000 + 34494735   ...lashPlayer-10.4-10.5.plugin          0x1984c698 0x195f4000 + 24592886   ...lashPlayer-10.4-10.5.plugin          0x19854625 0x195f4000 + 24919417   ...lashPlayer-10.4-10.5.plugin          0x198fa962 0x195f4000 + 31727068   ...lashPlayer-10.4-10.5.plugin          0x19904092 0x195f4000 + 32114109   ...lashPlayer-10.4-10.5.plugin          0x199053f6 0x195f4000 + 321637410  ...lashPlayer-10.4-10.5.plugin          0x19855958 0x195f4000 + 249685611  ...lashPlayer-10.4-10.5.plugin          0x198fa962 0x195f4000 + 317270612  ...lashPlayer-10.4-10.5.plugin          0x19904092 0x195f4000 + 321141013  ...lashPlayer-10.4-10.5.plugin          0x19905433 0x195f4000 + 321643514  ...lashPlayer-10.4-10.5.plugin          0x199060a6 0x195f4000 + 321962215  ...lashPlayer-10.4-10.5.plugin          0x199066a1 0x195f4000 + 322115316  ...lashPlayer-10.4-10.5.plugin          0x1994f178 0x195f4000 + 351884017  ...lashPlayer-10.4-10.5.plugin          0x19a04816 0x195f4000 + 426191018  ...lashPlayer-10.4-10.5.plugin          0x19a268a0 FlashPlayer_10_3_183_10_FlashPlayer + 19280

WZZZ · Answer

I think the issue with Safari is independent of the KPs. I&#x27;m not that great at reading Crash logs, but Exception Type:  EXC_BAD_ACCESS in the above log may suggest an issue with Safari (Flash Player) accessing Memory, which may or may not also be related to the Kernel Panics -- but probably only Safari related. Here, I just don&#x27;t know enough.Can you find any panic logs? Even ones from before will do.Have you run Rember? You can also check the RAM, among other things, with the Hardware Test in Extended. It can be pretty crappy at picking up errors, but if finds one it will be accurate and can be relied on.Message was edited by: WZZZ

WZZZ · Answer

RAM testing will be much more thorough using Memtest in single user mode. I don&#x27;t know if your Internet in 10.5 is availble from Safe Mode or not. But if it is, this is the download linkhttp://www.memtestosx.org/joomla/index.phpThe User Guide (PDF) will explain how to boot in single user mode and run Memtest.http://www.memtestosx.org/downloads/memtest422/Users_Guide.rtfAlso, what do you have in the following locations? SystemPreferences&gt;Accounts&gt;Log in Items~Library/LaunchAgents  (~ indicates your home folder Library / only indicates the HD Library)/Library/StartupItems/System/Library/StartupItems/System/Library/LaunchDaemons/Library/LaunchDaemonsMessage was edited by: WZZZ

JanetF · Answer

I&#x27;ve now run Rember and both RAM chips have passed all tests. Here is the last panic log I could find:Wed Jun 27 21:00:14 2012panic(cpu 1 caller 0x001AB0FE): Kernel trap at 0x001f829f, type 14&#x3D;page fault, registers:CR0: 0x8001003b, CR2: 0x161f9518, CR3: 0x01102000, CR4: 0x00000660EAX: 0x03f81404, EBX: 0x00000001, ECX: 0x00000000, EDX: 0x4489e045CR2: 0x161f9518, EBP: 0x349839d8, ESI: 0x040eef40, EDI: 0x040f4f00EFL: 0x00010202, EIP: 0x001f829f, CS:  0x00000008, DS:  0x004f0010Error code: 0x00000000Backtrace (CPU 1), Frame : Return Address (4 potential args on stack)0x349837a8 : 0x12b4c6 (0x45f91c 0x349837dc 0x13355c 0x0) 0x349837f8 : 0x1ab0fe (0x469a98 0x1f829f 0xe 0x469248) 0x349838d8 : 0x1a1713 (0x349838f0 0x23d1891c 0x349839d8 0x1f829f) 0x349838e8 : 0x1f829f (0xe 0x30190048 0x34980010 0x1a0010) 0x349839d8 : 0x1f992b (0x40eef40 0x20006416 0x0 0x2) 0x34983a38 : 0x1fc16b (0x40f4f68 0x40d1804 0x34983a88 0x31c1d9) 0x34983ac8 : 0x1fc296 (0x40066b0 0x3a6000 0x34983ae8 0x1a436f) 0x34983b88 : 0x1fd7af (0x0 0x0 0x200 0x0) 0x34983bd8 : 0x33e766 (0x40f4f00 0x40d1bbc 0x0 0x40d1804) 0x34983c08 : 0x343bae (0x40d1804 0x1 0x5fab6e0 0x0) 0x34983d18 : 0x344496 (0x628dc20 0x0 0x2 0x2) 0x34983da8 : 0x334bb7 (0x628dc20 0x2 0x0 0x4176e44) 0x34983dd8 : 0x1dff87 (0x628dc20 0x34983e68 0x34983e28 0x1a0468) 0x34983e28 : 0x338a86 (0x3f86b84 0x0 0x334b37 0x34983e68) 0x34983ea8 : 0x1f89fa (0x3f86b84 0x2 0x46bd324 0x1f7fb2) 0x34983ee8 : 0x1e22a2 (0x3f86b84 0x2 0x46bd324 0xf)           Backtrace continues...BSD process name corresponding to current thread: updateMac OS version:9L31aKernel version:Darwin Kernel Version 9.8.0: Wed Jul 15 16:55:01 PDT 2009; root:xnu-1228.15.4~1/RELEASE_I386System model name: iMac5,1 (Mac-F4228EC8)System uptime in nanoseconds: 1054236585097unloaded kexts:com.apple.kext.webfilter          1.2 - last unloaded 1032562800942loaded kexts:com.intego.iokit.VirusBarrierX6Service          10.6.15com.intego.iokit.BehavioralKext          1com.intego.iokit.VBX6NKE          1com.intego.kext.VirusBarrier.AppBarrierKPI          10.6.15com.intego.kext.VirusBarrierKPI          10.6.15com.apple.kext.webfilter          1.2 - last loaded 633362603024com.apple.kext.mcx.alr          1.0com.apple.filesystems.autofs          2.0.2com.apple.iokit.IOBluetoothSerialManager          2.1.9f10com.apple.driver.AppleHWSensor          1.9d0com.apple.driver.AppleUpstreamUserClient          2.7.5com.apple.driver.AppleHDA          1.7.1a2com.apple.kext.ATY_Wormy          5.4.8com.apple.ATIRadeonX1000          5.4.8com.apple.Dont_Steal_Mac_OS_X          6.0.3com.apple.driver.AppleHDAController          1.7.1a2com.apple.driver.AudioIPCDriver          1.0.6com.apple.driver.AppleIRController          113com.apple.driver.ACPI_SMC_PlatformPlugin          3.4.0a17com.apple.driver.AppleLPC          1.3.1com.apple.driver.AppleBacklight          1.6.0com.apple.iokit.IOFireWireIP          1.7.7com.apple.driver.CSRUSBBluetoothHCIController          2.1.9f10com.apple.driver.AppleUSBHIDMouse          1.2.4b3com.apple.driver.AppleUSBMergeNub          3.5.2com.apple.iokit.IOSCSIMultimediaCommandsDevice          2.1.1com.apple.iokit.SCSITaskUserClient          2.1.1com.apple.driver.XsanFilter          2.7.91com.apple.iokit.IOATAPIProtocolTransport          1.5.3com.apple.iokit.IOAHCIBlockStorage          1.2.2com.apple.driver.AppleUSBHub          3.4.9com.apple.iokit.IOUSBUserClient          3.5.2com.apple.driver.AppleAHCIPort          1.7.0com.apple.driver.AppleIntelPIIXATA          2.0.1com.apple.driver.AirPortBrcm43xx          367.91.22com.apple.driver.AppleFWOHCI          3.9.7com.apple.iokit.AppleYukon2          3.1.13b2com.apple.driver.AppleUSBEHCI          3.4.6com.apple.driver.AppleUSBUHCI          3.5.2com.apple.driver.AppleEFINVRAM          1.2.0com.apple.driver.AppleRTC          1.2.3com.apple.driver.AppleHPET          1.4com.apple.driver.AppleACPIPCI          1.2.5com.apple.driver.AppleACPIButtons          1.2.5com.apple.driver.AppleSMBIOS          1.4com.apple.driver.AppleACPIEC          1.2.5com.apple.driver.AppleAPIC          1.4com.apple.security.seatbelt          107.12com.apple.nke.applicationfirewall          1.8.77com.apple.security.TMSafetyNet          3com.apple.driver.AppleIntelCPUPowerManagement          76.2.0com.apple.driver.DiskImages          199com.apple.BootCache          30.4com.apple.iokit.IOSerialFamily          9.4com.apple.driver.DspFuncLib          1.7.1a2com.apple.iokit.IOHDAFamily          1.7.1a2com.apple.iokit.IOAudioFamily          1.6.9fc5com.apple.kext.OSvKernDSPLib          1.1com.apple.driver.IOPlatformPluginFamily          3.4.0a17com.apple.driver.AppleSMC          2.3.1d1com.apple.iokit.IONDRVSupport          1.7.3com.apple.iokit.IOGraphicsFamily          1.7.3com.apple.driver.AppleUSBBluetoothHCIController          2.1.9f10com.apple.iokit.IOBluetoothFamily          2.1.9f10com.apple.driver.AppleHIDMouse          1.2.4b3com.apple.iokit.IOUSBHIDDriver          3.4.6com.apple.driver.AppleUSBComposite          3.2.0com.apple.iokit.IOSCSIBlockCommandsDevice          2.1.1com.apple.iokit.IOBDStorageFamily          1.5com.apple.iokit.IODVDStorageFamily          1.5com.apple.iokit.IOCDStorageFamily          1.5com.apple.iokit.IOSCSIArchitectureModelFamily          2.1.1com.apple.iokit.IOAHCIFamily          1.5.0com.apple.iokit.IOATAFamily          2.0.1com.apple.iokit.IO80211Family          216.1com.apple.iokit.IOFireWireFamily          3.4.9com.apple.iokit.IONetworkingFamily          1.6.1com.apple.iokit.IOUSBFamily          3.5.2com.apple.driver.AppleEFIRuntime          1.2.0com.apple.iokit.IOSMBusFamily          1.1com.apple.iokit.IOStorageFamily          1.5.6com.apple.iokit.IOHIDFamily          1.5.5com.apple.driver.AppleACPIPlatform          1.2.5com.apple.iokit.IOACPIFamily          1.2.0com.apple.iokit.IOPCIFamily          2.6

WZZZ · Answer

Completely uninstall the Intego. This may be causing the KPs. Or, a bit more complicated, you can temporarily disable the program by disabling any of its related .kext(s)  by doing the following: Open Terminal in Applications&gt;Utilties and copy/pastesudo kextunloadImportant, leave a space after kextunloadNext, navigate to the /System/Library/ and select Extensions. Inside that folder, find the related .kext(s) in question, which you should drag into the Terminal window. (After dragging it in, the file will stay where it belongs in its original location.) This will automatically fill the Terminal window with the name and path to the file. Do these one by one.This is an example only of what the full command will then look like; it will not necessarily be found on your computer.sudo kextunload /System/Library/Extensions/PaceSupportFamily.kext/Hit return. If you have never used the sudo prefix before, you will get a warning, which you can disregard. Then enter your admin password, which you won&#x27;t see on the screen as you type it in and hit return. Wait for the $ sign prompt to reappear, which will indicate the extension has been unloaded. Then just close the window.This will have the effect of disabling the program. If it fails to be the source of the problem, to reload/enable it, substitute kextload for kextunload, using the above procedure.

rkaufmann87 · Answer

I completely agree with WZZZ, this issue is being caused by Virus Barrier. Please contact the manufacturer for uninstall instructions, unfortunately many anti virus apps cause more problems than they solve. After un-installing restart in Safe Mode to clear some caches, and then restart normally. If you aren&#x27;t familiar with a Safe Mode restart when you hear the startup tone hold down the Shift Key until you see a progress bar appear and then let it boot. After it has fully booted restart normally.

JanetF · Answer

I&#x27;ve uninstalled Virus Barrier, restarted in Safe Mode, restarted normally and it still gets as far as the blue desktop and then restarts.I am beginning to think I&#x27;ll need to reformat the hardrive and reinstall everything from scratch but still no idea what has actually caused the error.

JanetF · Answer

In reply to WZZZ re this part:Also, what do you have in the following locations?SystemPreferences&gt;Accounts&gt;Log in Items  iTunes Helper has a tick in the Hide box and Microsoft Database has no tick. There are no other items listed.~Library/LaunchAgents  (~ indicates your home folder Library / only indicates the HD Library) com.Adobe.ARM.lots of numbers .plist, com.google.keystone.agent.plist/Library/StartupItems This folder is empty/System/Library/StartupItems This folder is empty/System/Library/LaunchDaemons There&#x27;s 124 items in this folder. /Library/LaunchDaemons com.microsoft.office.licensing.helper.plist and com.trusteer.rooks.rooksd.plistI&#x27;ve noticed a folder called &#x27;lost+found&#x27; dated 27 June. There&#x27;s a subfolder called 20843907 but the folder is empty

WZZZ · Answer

Lost+Found probably created as a result of the hard shutdowns.http://www.techradar.com/news/computing/apple/explained-lostfound-folder-in-os-x -712519But you might also want to check the health of your drive using the free demo of SMART Utilityhttp://www.volitans-software.com/smart_utility.phpI&#x27;d still probably test the RAM.