10.10.4 kernel panic

The kernel panic log would have been a better thing to post.

But, the panic is most likely caused by Sophos. That is pretty much all it is good for.

RobertMU wrote:

Not sure how to get that log. I put Sophos on after these panics started b/c I wanted to check for viruses.

Doubling down on bad, eh?

Open Console app.

If the log list isn't showing on the left, click the Show Log List button

From the list, find System Diagnostic Reports and click on the disclosure triangle to the left of the heading name.

Find the latest "Kernel…panic" report.

Copy all of the info from the pane on the right except the Anonymous UUID line.

Paste that into a reply here.

Kernel Panic reports

<http://support.apple.com/kb/ht2546>

But Barney-15E is most likely correct that Sophos is the cause (and I see McAfee in the mix as well). Most anti-malware apps attempt to inject themselves into the Mac OS X kernel using non-published interfaces or just reaching in and doing what they want, but if the kernel changes in any way, such as upgrading to 10.10.4, these unpublished APIs may change or the data structures being handled may change, and the anti-malware may now corrupt the kernel's memory or try to follow what it things is a pointer and end up in never-never-land resulting in a panic.

You really do not need an anti-malware product. Mac OS X includes its own

<http://www.thesafemac.com/mmg-builtin/>

When you have kernel panics, the pertinent information is in the panic report. The "etrecheck" stuff is not pertinent.

These instructions must be carried out as an administrator. If you have only one user account, you are the administrator.

Launch the Console application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

In the Console window, select

DIAGNOSTIC AND USAGE INFORMATION ▹ System Diagnostic Reports

(not Diagnostic and Usage Messages) from the log list on the left. If you don't see that list, select

View ▹ Show Log List

from the menu bar.

There is a disclosure triangle to the left of the list item. If the triangle is pointing to the right, click it so that it points down. You'll see a list of reports. A panic report has a name that begins with "Kernel" and ends in ".panic". Select the most recent one. The contents of the report will appear on the right. Use copy and paste to post the entire contents—the text, not a screenshot.

If you don't see any reports listed, but you know there was a panic, you may have chosen Diagnostic and Usage Messages from the log list. Choose DIAGNOSTIC AND USAGE INFORMATION instead.

In the interest of privacy, I suggest that, before posting, you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if it’s present (it may not be.)

Please don’t post other kinds of diagnostic report.

I know the report is long, maybe several hundred lines. Please post all of it anyway.

When you post the report, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the forum software. Please post the text on Pastebin, then post a link here to the page you created.

Uninstall Sophos and McAfee.

McAfee Uninstall Resources is near bottom of the page

Sophos Un-install

If you can't start up and log in in the usual way, try in safe mode.

During startup, you’ll see a progress bar, and then the login screen, which appears even if you normally log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

It's under System Diagnostic Reports.

It sounds like your biggest problem is an erratic cursor. It may or may not be related to the kernel panics.

There are several possible causes for this issue. Please take each of the following steps that you haven't already tried until it's resolved. Some may not apply in your case.

1. Follow the instructions in this support article, and also this one, if applicable. A damaged or defective AC adapter could be the cause, even if it's the right kind.

2. Press down all four corners of the trackpad at once and release. If there's any effect, it's likely to be temporary, and in that case the unit must be serviced or replaced.

3. Open the Bluetooth pane in System Preferences and delete all pointing devices other than the trackpad, if applicable. Disconnect any USB pointing devices. By a "pointing device," I mean a peripheral that moves the cursor, such as a trackpad, mouse, trackball, or graphics tablet. A plain keyboard is not a pointing device.

4. If your model has an infrared receiver for use with an Apple Remote, disable it.

5. Start up in safe mode and test, preferably without launching any third-party applications. If you don't have the problem in safe mode, but it comes back when you restart as usual, stop here and post your results. Do the same if you can't start in safe mode. If there was no difference in safe mode, go on to the next step.

6. Reset the System Management Controller.

7. If you're using a Bluetooth trackpad or mouse, investigate potential sources of interference, including USB 3 devices.

8. A swollen battery in a portable computer can impinge on the trackpad from below and cause erratic behavior. If you have trouble clicking the trackpad, this is likely the reason. The battery must be replaced without delay.

9. A defective peripheral device or a damaged cable can cause the built-in trackpad of a MacBook to behave erratically. If you're using any wired peripherals, disconnect them one at a time and test.

10. There's also a report of erratic cursor movements caused by an external display that was connected but not turned on.

11. If you use Handoff, disable it in the General pane of System Preferences.

12. If none of the above applies, or if you have another reason to think that your computer is being remotely controlled, remove it from the network by turning off Wi-Fi (or your Wi-Fi access point), disconnecting from a Bluetooth network link, and unplugging the Ethernet cable or USB modem, whichever is applicable. If the cursor movements stop at once, you should suspect an intrusion.

13. Make a "Genius" appointment at an Apple Store to have the machine and/or external trackpad tested.