You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

mach_kernel document appeared

This morning a file appeared in my documents titled, "mach_kernel". The file says it was created and edited on Sept. 29, 2013, at 2:34 pm , yet the first time it appeared in the documents file is this morning, When I went to trash it, because it had no info, Finder asked for my password before I could move the file to the trash, this is not usual and I am afraid it is some type of virus, because my computer has been slow lately. Help!

MacBook Air, OS X Mountain Lion (10.8.5)

Posted on Oct 8, 2013 7:19 AM

Reply
74 replies

Dec 24, 2013 6:56 AM in response to crzyhrse

Googling around seems to suggest that from the boot cd one has to use terminal to move files, and know the paths as well...


I think you said you have access to another mac... Can you make a regular boot cd or thumb using that mac, which I believe will have a finder, there are directions on the internet to do that (I have a boot thumb for mountain lion I made a while back via a $20 mointain lion system from the apple store), and use that to access your files..?

Dec 24, 2013 8:00 AM in response to Shooroopski

Will try to take the HD out from Mac, put it to case with controller and connect to another Mac, and move that file to root.


If you've got another Mac, use target disk mode to connect the two. No need to remove the drive from the Mac.


http://support.apple.com/kb/ph3838


You will probably still need to repair permissions.


If that doesn't work, you're really going to have to reinstall the system. I'm guessing you're not interested in downgrading to Snow Leopard, in which case downloading is the only option. Are there any Apple Stores there? If so, they may have a high-speed wifi network you could use to download it, or may be able to help you obtain the installer some other way.


Once you've got the installer, back it up somewhere so that you can use it again in the future if you need it. You can make a bootable install disk for Mountain Lion by following the instructions here:


http://osxdaily.com/2012/02/17/make-bootable-os-x-10-8-mountain-lion-usb-install -drive/


Note that the directions are different for Mavericks, if you upgrade to that at some point.

Dec 24, 2013 8:36 AM in response to Shooroopski

I, personally, wouldn't dig deeper by completely reinstalling unless absolutely necessary. On the safe side I'd assume every file might erase, so you'd need to have that all backed up beforehand. As people suggested, it's probably a matter of using the proper relatively simple code and ensuring permissions. The suggested disk utility (careful what you use down there, though!) has worked for me as well when locked out of external drives, when I used verify disk. As for the path to the trash from the terminal, I just dragged a file into the terminal (it then supplies the path) and it looks like it's just .Trash/yourfile, and I noticed it also denied my permission and thought I was staff with reading privileges only.


I have a really stupid suggestion: can Mac download/auto-update you another mach file to the root of that computer? They auto-update other apps just b/c you're online. You'd have to contact them. Or, can they send you that file via any system/email/computer with full permissions so you can move it yourself no matter who the heck your computer thinks you are?


Otherwise, you might give that file writing permissions for everyone from the terminal (if disk utility disk verify doesn't give you back admin access). Then drag it or write where it should go in the terminal. And make it invisible if you wish. You could always change the permissions back to admin only with read for the others when you get it placed.


ls -l filenameWithFullPath tells you it's permissions with admin first, then group, then others...if I recall.

chmod 777 .Trash/mach_kernel should give it completely open permissions

mv .Trash/mach_kernel / should put it in the root

chmod 744 /mach_kernel will restore admin only privileges

sudo chflags hidden /mach_kernel should hide the file



If you didn't change the permissions on the trash file, use:

sudo mv .Trash/mach_kernel / should recognize you as admin with admin privileges to move the file

sudo chflags hidden /mach_kernel


More or less, if you have access to the terminal, something along these lines should be more or less correct. (On Windows the root is /. and I'm not doing this in real time with you, so there may be a slight discrepancy.). If there is an error probably someone will correct it, but the above won't do any damage.

Dec 24, 2013 9:03 AM in response to Elaine Morrison

It looks like the root is / and /. more or less equally, so that should put you at root.

If you are locked out and thought of as staff try sudo before all commands on that file. I had an issue with an external drive, forgot to use sudo, and only disk verify would restore my command. Since that worked and I quickly changed the drive permissions I don't know if sudo would have done the trick. Sudo is worth trying before you admit defeat on any route.

Dec 24, 2013 9:17 AM in response to Elaine Morrison

That command would work to move the file to the root of the drive, but to avoid possibly entering the command incorrectly, just move it from the desktop.


Open both the Trash folder and the startup drive from its icon on the desktop. Drag and drop mach_kernel out of the trash to the open drive folder so it ends up next to the Applications, Library, Users and System folders. You may need to enter your admin password to complete the move.


Now use Terminal to hide the file. Also run Repair Permissions in Disk Utility to have the mach_kernel's permissions reset to system ownership.

Dec 24, 2013 9:28 AM in response to Elaine Morrison

As for the path to the trash from the terminal, I just dragged a file into the terminal (it then supplies the path) and it looks like it's just .Trash/yourfile


That does not work. That's the path to the file when you are able to boot from that system and can log in. In this case, the system can only boot into recovery mode, and from there, that is not the correct path to the file.

Dec 24, 2013 10:22 AM in response to Elaine Morrison

Okay I have to reply somewhere to someone because my mailbox over-floweth.


Please read:


Upon doing a simple update last month, my machine crashed to the point where

nothing the Applecare rep could do could boot my machine. Eventually, after at least 5 failed attempts to find

a solution to my issue, a senior supervisor tied me directly to their

server and re-installed my system software. When he completed the process, I confessed to having

removed the mach_kernel file from my hard drive. After reading all the crazy posts on this site about the mach_kernel debacle, I thought 'could this be the problem?' Was everyone who posted right?

He said (in no uncertain terms) that the mach_kernel file was nothing and to toss it.

It wouldn't hurt anything. He said my issue was just a glitch in the upload of the update. It happens.

Again... senior supervisor!


So, all of you folks with OCD, you can ignore my advice and drive yourselves nuts, or take my advice

and know that it's nothing. I truly hope this completes this discussion because my mailbox is developing a

hernia : )


Pass it on.

Dec 24, 2013 11:52 AM in response to thomas_r.

Other than the usual mysterious and pretty-icon information usually associated with Mac I never found exactly what besides 4 radical options the user can access. You would intimate there is an accessible terminal, as you mention the path to the other hard drive (from there I suppose you'd get the usual path to the HD files). As I don't want to mess with that mode myself while everything is operating normally, it would be interesting to know what crucial features can be accessed and the path into the regular HD.


Since this isn't my problem you don't need to reply. You don't need to pseudo-reply not really replying either. I woke up to 20 posts telling someone to dump his hard drive losing no data along the way and attempted to offer what answer I could knowing it would be improved upon by someone with more direct experience. Quoting me while saying This doesn't work while also not providing the exact answer doesn't fool anyone.

mach_kernel document appeared

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.