Aurora1967

Q: mach_kernel document appeared

This morning a file appeared in my documents titled, "mach_kernel". The file says it was created and edited on Sept. 29, 2013, at 2:34 pm , yet the first time it appeared in the documents file is this morning, When I went to trash it, because it had no info, Finder asked for my password before I could move the file to the trash, this is not usual and I am afraid it is some type of virus, because my computer has been slow lately. Help!

MacBook Air, OS X Mountain Lion (10.8.5)

Posted on Oct 8, 2013 7:19 AM

Close

Q: mach_kernel document appeared

  • All replies
  • Helpful answers

first Previous Page 5 of 5
  • by crzyhrse,

    crzyhrse crzyhrse Dec 24, 2013 6:42 AM in response to Shooroopski
    Level 1 (0 points)
    Dec 24, 2013 6:42 AM in response to Shooroopski

    Maybe google around, see if there is a way to get past the initial screens when you boot from the install disk, to access a finder, and maybe from there get to files and folders..?

     

    I might do that myself now, just out of curiousity...

  • by crzyhrse,

    crzyhrse crzyhrse Dec 24, 2013 6:56 AM in response to crzyhrse
    Level 1 (0 points)
    Dec 24, 2013 6:56 AM in response to crzyhrse

    Googling around seems to suggest that from the boot cd one has to use terminal to move files, and know the paths as well...

     

    I think you said you have access to another mac...  Can you make a regular boot cd or thumb using that mac, which I believe will have a finder, there are directions on the internet to do that (I have a boot thumb for mountain lion I made a while back via a $20 mointain lion system from the apple store), and use that to access your files..?

  • by thomas_r.,

    thomas_r. thomas_r. Dec 24, 2013 8:00 AM in response to Shooroopski
    Level 7 (30,944 points)
    Mac OS X
    Dec 24, 2013 8:00 AM in response to Shooroopski

    Will try to take the HD out from Mac, put it to case with controller and connect to another Mac, and move that file to root.

     

    If you've got another Mac, use target disk mode to connect the two. No need to remove the drive from the Mac.

     

    http://support.apple.com/kb/ph3838

     

    You will probably still need to repair permissions.

     

    If that doesn't work, you're really going to have to reinstall the system. I'm guessing you're not interested in downgrading to Snow Leopard, in which case downloading is the only option. Are there any Apple Stores there? If so, they may have a high-speed wifi network you could use to download it, or may be able to help you obtain the installer some other way.

     

    Once you've got the installer, back it up somewhere so that you can use it again in the future if you need it. You can make a bootable install disk for Mountain Lion by following the instructions here:

     

    http://osxdaily.com/2012/02/17/make-bootable-os-x-10-8-mountain-lion-usb-install -drive/

     

    Note that the directions are different for Mavericks, if you upgrade to that at some point.

  • by Elaine Morrison,

    Elaine Morrison Elaine Morrison Dec 24, 2013 8:36 AM in response to Shooroopski
    Level 1 (0 points)
    Dec 24, 2013 8:36 AM in response to Shooroopski

    I, personally, wouldn't dig deeper by completely reinstalling unless absolutely necessary. On the safe side I'd assume every file might erase, so you'd need to have that all backed up beforehand. As people suggested, it's probably a matter of using the proper relatively simple code and ensuring permissions. The suggested disk utility (careful what you use down there, though!) has worked for me as well when locked out of external drives, when I used verify disk. As for the path to the trash from the terminal, I just dragged a file into the terminal (it then supplies the path) and it looks like it's just .Trash/yourfile, and I noticed it also denied my permission and thought I was staff with reading privileges only.

     

    I have a really stupid suggestion: can Mac download/auto-update you another mach file to the root of that computer? They auto-update other apps just b/c you're online. You'd have to contact them. Or, can they send you that file via any system/email/computer with full permissions so you can move it yourself no matter who the heck your computer thinks you are?

     

    Otherwise, you might give that file writing permissions for everyone from the terminal (if disk utility disk verify doesn't give you back admin access). Then drag it or write where it should go in the terminal. And make it invisible if you wish. You could always change the permissions back to admin only with read for the others when you get it placed.

     

    ls -l filenameWithFullPath tells you it's permissions with admin first, then group, then others...if I recall.

    chmod 777 .Trash/mach_kernel should give it completely open permissions

    mv .Trash/mach_kernel / should put it in the root

    chmod 744 /mach_kernel will restore admin only privileges

    sudo chflags hidden /mach_kernel should hide the file

     

     

    If you didn't change the permissions on the trash file, use:

    sudo mv .Trash/mach_kernel / should recognize you as admin with admin privileges to move the file

    sudo chflags hidden /mach_kernel

     

    More or less, if you have access to the terminal, something along these lines should be more or less correct. (On Windows the root is /. and I'm not doing this in real time with you, so there may be a slight discrepancy.). If there is an error probably someone will correct it, but the above won't do any damage.

  • by Elaine Morrison,

    Elaine Morrison Elaine Morrison Dec 24, 2013 9:03 AM in response to Elaine Morrison
    Level 1 (0 points)
    Dec 24, 2013 9:03 AM in response to Elaine Morrison

    It looks like the root is / and /. more or less equally, so that should put you at root.

    If you are locked out and thought of as staff try sudo before all commands on that file. I had an issue with an external drive, forgot to use sudo, and only disk verify would restore my command. Since that worked and I quickly changed the drive permissions I don't know if sudo would have done the trick. Sudo is worth trying before you admit defeat on any route.

  • by Kurt Lang,

    Kurt Lang Kurt Lang Dec 24, 2013 9:17 AM in response to Elaine Morrison
    Level 8 (38,049 points)
    Mac OS X
    Dec 24, 2013 9:17 AM in response to Elaine Morrison

    That command would work to move the file to the root of the drive, but to avoid possibly entering the command incorrectly, just move it from the desktop.

     

    Open both the Trash folder and the startup drive from its icon on the desktop. Drag and drop mach_kernel out of the trash to the open drive folder so it ends up next to the Applications, Library, Users and System folders. You may need to enter your admin password to complete the move.

     

    Now use Terminal to hide the file. Also run Repair Permissions in Disk Utility to have the mach_kernel's permissions reset to system ownership.

  • by thomas_r.,

    thomas_r. thomas_r. Dec 24, 2013 9:28 AM in response to Elaine Morrison
    Level 7 (30,944 points)
    Mac OS X
    Dec 24, 2013 9:28 AM in response to Elaine Morrison

    As for the path to the trash from the terminal, I just dragged a file into the terminal (it then supplies the path) and it looks like it's just .Trash/yourfile

     

    That does not work. That's the path to the file when you are able to boot from that system and can log in. In this case, the system can only boot into recovery mode, and from there, that is not the correct path to the file.

  • by Elaine Morrison,

    Elaine Morrison Elaine Morrison Dec 24, 2013 9:36 AM in response to thomas_r.
    Level 1 (0 points)
    Dec 24, 2013 9:36 AM in response to thomas_r.

    What's his path? Where is recovery mode located?

  • by dgra,

    dgra dgra Dec 24, 2013 10:22 AM in response to Elaine Morrison
    Level 1 (0 points)
    Dec 24, 2013 10:22 AM in response to Elaine Morrison

    Okay I have to reply somewhere to someone because my mailbox over-floweth.

     

    Please read:

     

    Upon doing a simple update last month, my machine crashed to the point where

    nothing the Applecare rep could do could boot my machine. Eventually, after at least 5 failed attempts to find

    a solution to my issue, a senior supervisor tied me directly to their

    server and re-installed my system software. When he completed the process, I confessed to having

    removed the mach_kernel file from my hard drive. After reading all the crazy posts on this site about the mach_kernel debacle, I thought 'could this be the problem?' Was everyone who posted right?

    He said (in no uncertain terms) that the mach_kernel file was nothing and to toss it.

    It wouldn't hurt anything. He said my issue was just a glitch in the upload of the update. It happens.

    Again... senior supervisor!

     

    So, all of you folks with OCD, you can ignore my advice and drive yourselves nuts, or take my advice

    and know that it's nothing. I truly hope this completes this discussion because my mailbox is developing a

    hernia : )

     

    Pass it on.

  • by thomas_r.,

    thomas_r. thomas_r. Dec 24, 2013 11:23 AM in response to Elaine Morrison
    Level 7 (30,944 points)
    Mac OS X
    Dec 24, 2013 11:23 AM in response to Elaine Morrison

    What's his path? Where is recovery mode located?

     

    As I mentioned in one of my previous posts, it depends on the name of his hard drive and his username.

     

    As for recovery mode, that's the only mode he's currently able to start up in at the moment. For information about recovery mode, see:

     

    http://support.apple.com/kb/ht4718

  • by Elaine Morrison,

    Elaine Morrison Elaine Morrison Dec 24, 2013 11:52 AM in response to thomas_r.
    Level 1 (0 points)
    Dec 24, 2013 11:52 AM in response to thomas_r.

    Other than the usual mysterious and pretty-icon information usually associated with Mac I never found exactly what besides 4 radical options the user can access. You would intimate there is an accessible terminal, as you mention the path to the other hard drive (from there I suppose you'd get the usual path to the HD files). As I don't want to mess with that mode myself while everything is operating normally, it would be interesting to know what crucial features can be accessed and the path into the regular HD.

     

    Since this isn't my problem you don't need to reply. You don't need to pseudo-reply not really replying either. I woke up to 20 posts telling someone to dump his hard drive losing no data along the way and attempted to offer what answer I could knowing it would be improved upon by someone with more direct experience. Quoting me while saying This doesn't work while also not providing the exact answer doesn't fool anyone. 

  • by thomas_r.,

    thomas_r. thomas_r. Dec 24, 2013 12:34 PM in response to Elaine Morrison
    Level 7 (30,944 points)
    Mac OS X
    Dec 24, 2013 12:34 PM in response to Elaine Morrison

    Quoting me while saying This doesn't work while also not providing the exact answer doesn't fool anyone.

     

    I'm not sure what the attitude is about, but I already provided that answer, as exactly as is possible. See:

     

    Re: mach_kernel document appeared

  • by Elaine Morrison,

    Elaine Morrison Elaine Morrison Dec 24, 2013 12:38 PM in response to thomas_r.
    Level 1 (0 points)
    Dec 24, 2013 12:38 PM in response to thomas_r.

    Beauty! Thx!

  • by Shooroopski,

    Shooroopski Shooroopski Dec 24, 2013 11:34 PM in response to thomas_r.
    Level 1 (0 points)
    Dec 24, 2013 11:34 PM in response to thomas_r.

    Yes, this is exactly what returned the mach_kernel to its place from trash. Thanx everyone, cheers ! )

  • by JohnnyChin95,

    JohnnyChin95 JohnnyChin95 Mar 18, 2015 5:52 AM in response to Aurora1967
    Level 1 (5 points)
    Mar 18, 2015 5:52 AM in response to Aurora1967

    I have same proble too!

    but this apple article helped me out! check it!

    OS X: mach_kernel visible in the Finder - Apple Support

first Previous Page 5 of 5