Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

OSX 10.11.3 Update - All Applications Gone - Safe boot as well

Installed 10.11.3 from the Mac Store this morning, this is my story if someone else is searching for a similar situation.

MacBook Pro Retina 15in - Late 2013, 1TB SSD, 16GB Ram , 2.3 i7

I'm running FileVault and was running Clam AV.


I believe the important issue is the Claim AV based on comments I found in a few news articles.

Apparently some AV suites have fought this update on install.

I can't even open the console app right now to review my console logs to verify AV took action.


After install/reboot, I was able to login to my local account just fine.

But then everything was slow.

GeekTool didn't load

Dock came up minutes later vs. normal 30-60 seconds.

All dock icons had the missing application image.


I was able to open Finder after a beach ball of death waiting period.

There i only saw mail.app with a bad icon image.

The utilities folder but no applications listed.


My home folder however, dropbox, ect still showed as populated...so at least my files are intact.


After reading a few other comments I booted into safe bootdownloaded the patch manually...

And tried to do a manual install with AV off... it's not launching... b/c all applications are dead...

Still no love on reboot.


I may have a bricked machine here, just wanted to share my story.

Posting images in one second.

Posted on Jan 27, 2016 7:53 AM

Reply
18 replies

Jan 27, 2016 8:04 AM in response to docgoku

remove ALL external devices except keyboard and mouse

reset SMC as per this Apple Computer article and proceed with resting the PRAM/NVRAM at the bottom of the same article

Resetting the System Management Controller (SMC) on your Mac - Apple Support

boot into safe mode with all devices still disconnected

Try safe mode if your Mac doesn't finish starting up - Apple Support


if your computer is still "bricked" you have three options.

1) try and find what the cause is and step by step hope you can remedy it.


2) If you have a time machine backup use it to restore your system to a previous state by booting into recovery mode and restoring that backup

Use Time Machine to back up or restore your Mac - Apple Support

and 3) if this is not possible and you have no other option use system restore or internet restore to bring your computer back to a factory state.

your current OS and it's data will be destroyed unless you can perform this on another HD or another partition which is clean/empty.

OS X: About OS X Recovery - Apple Support

Jan 27, 2016 9:04 AM in response to JimmyCMPIT

Just did SMC and PRAM/NVRAM resets...no help there.

Seems to be common that SMC or PRAM reset doesn't help, across multiple forums that I've read this morning.


I consider loosing applications and their ability to launch as a "brick"...just from a single update.

I've run OSX for 12+ years, I'm in the IT industry. Not my first time debugging but this is the first time I've had an OSX update cause this much of an issue.


After letting it sit for about 30mins I started to get a list of applications in Finder.

However, they can not be launched.


I do have a time machine backup but I'm making a 2nd now, raw copy of all my Fusion and Parallels VMs that I only backup every 2 weeks.

I will have to do a clean OSX rebuild.


Right now I've moved the MB Pro off to my 2nd desk, rolling with my Surface 3 and Lenovo X220 rest of this week.

Will swing back to this once a root cause is found with 10.11.3.

We've warned our OSX users to hold off on their home rigs and disabled update on the corporate side.

User uploaded file

Jan 27, 2016 9:45 AM in response to docgoku

Before you take drastic measures, you may want to try this:


1) Uninstall the antivirus completely (and make a note never to reinstall that)

2) Download the combo update and run it.


Antivirus on the mac only serve to hinder performance and cause trouble; and the same should be said about most programs that claim to "clean" your drive. Run, don't walk, away from those.

Jan 27, 2016 9:59 AM in response to Luis Sequeira1

1) AV is dead b/c all applications are dead. Even then, as I stated in the first post, the update will install outside of Mac Store. The issue persists.

I've also re-installed the update in safe boot, connecting to another mac over the network to copy the 10.11.3 DMG to my desktop to run. All is crazy slow but it would restart and install.


2) Yup, did that.


My opinion, OSX is just as/if not more prone to attack as windows/linux/ect.

I'm not installing ad-ware junk to run my AV sweeps. I've seen the ton of "clean my mac" posts in this forum. Nuts...


I've used a number of products in my work on OSX from Symantec, Sophos, Clam AV, RSA ECAT, and Cylance.

Trust that I've followed hardening guides and take security seriously.


Just a few:

A few guides on hardening OS X

Jan 27, 2016 10:09 AM in response to docgoku

I see that you are a person who takes security very seriously.

I can't object to that, of course.

But I do see computing in a different perspective.

The number of mac virus in the wild is zero. Antivirus are known to cause problems and degrade performance, so I choose never to use that.


If you deal with sensitive data that must be kept secret, then File Vault is probably a good idea. I have, however, seen a few horror stories of users who have lost access to their data. My fear of losing my data because of File Vault issues is greater than my fear that someone else may access my data for lack of encription.

Jan 27, 2016 1:31 PM in response to docgoku

Louis is correct in this.

Mac AV is not Window AV as Mac OS in not Windows. A windows centric approach to security is a recipe for disaster on the mac and while Windows developers work with many of the commercial AV development process mac OS does not. I've tested a dozen mac commercial AV products for companies and before I even started using these forums my findings were they are disastrous.

and while you have posted a significant number of good reads none of these potential points of failure have either made it to distributed code, or a white paper as a theory and none of these commercial AV products have any track record of thwarting these potentials in a real life situation if they did suddenly find distribution outside of a securities lab. What they do have however is a undeniable history as to the root cause of OS X instability as reported by countless users on these forums who have discovered removing the offending AV has cleared up a litany of issues but not offered any real security.

Jan 27, 2016 2:23 PM in response to JimmyCMPIT

None of my AV discussion is windows centered. AV is simply another layer of many on my OSX host.

All signature based products are problematic and of limited effectiveness.

With that said, AV or whitelisting has a place at the table.


OSX is indeed a target, this is not theory.... but you can believe what you will. It's your privacy/data.

https://www.hackread.com/scarlet-mimic-espionage-malware-campaign-targeting-acti vists/


All of this...doesn't help with the issue at hand.

10.11.3 patch and the host of issues from Safari to Mail.

Jan 27, 2016 9:58 PM in response to docgoku

docgoku wrote:


I believe the important issue is the Claim AV based on comments I found in a few news articles.

Apparently some AV suites have fought this update on install.

I can assure you that ClamXav was not responsible. I provide uncompensated Tech Support on the ClamXav Forum and have access to all the Help Desk Tickets that have been filed to date and there has not been a single report concerning such a problem, other than yours. I have also personally installed 10.11.3 multiple times on my computer without issue.


I would have to agree that some A-V software has been shown to interfere with new security features in El Capitan and developers are scrambling to fix the problem, but since ClamXav has no Kernel Extensions and only one background process (Sentry) which quits before installation begins, there is nothing to interfere.

Jan 27, 2016 11:35 PM in response to docgoku

docgoku wrote:


My opinion, OSX is just as/if not more prone to attack as windows/linux/ect.

I can't disagree that OS X is probably as prone to attack as those other platforms, but numbers to date show that it's not yet under attack to the extent that Windows platforms are. According to one Security specialist that post here frequently, there were only four new OS X threats (other than Adware) discovered in 2015. That's the lowest it's been in several years now.


Not sure why you posted the hackread article about targeted attacks against social rights activists in China and well as Indian / Russian government agencies that were all Windows based. There have been targeted attacks against minority sympathizers who are OS X users, but all the ones we know about were using very old vulnerabilities that were patched years ago. I suspect the hope was these targets were using obsolete systems.


As you say, none of this contributes to solving your current issue, but I would be happy to discuss the facts with you once you are back in business.

Jan 28, 2016 6:59 AM in response to MadMacs0

Thanks for the info on Clam, that's good to know it's looking clean with regards to this patch.

Perhaps I can rule it out as the source/root cause.


Agreed, OSX is much less of a target. That is why we use it for our host operating system. Easier to secure and more obscure than windows.


In the case of the article, there were multiple prongs to the campaign, one loader targeted at OSX the others were windows focused.

We are seeing many newer malware platforms being developed for multi-OS functionality.

Still rare, but 2015 was a big(er) year. Angler Exploit Kit for example, depending on where it's hosted and what version of Flash is exploited can drop some fun things.


Nine distinct loader families were developed by Scarlet Mimic to distribute FakeM. The hacker group is also trying to expand the scope of its attacks by using other tools with FakeM such as CallMe Trojan and Psylo. CallMe exploits Mac OSX while Psylo is similar to FakeM and shares infrastructure with another Trojan MobileOrder

Jan 28, 2016 8:41 AM in response to docgoku

if you are running Mac Office 2008 and you have not patched since 2009 your system is vulnerable to the attack you mention by name, especially if you are a Tibetan activist, otherwise if your an activist running running a patched MS office 2008 or more likely your an activist running something like Open Office or Libre Office (because what true activist is going to give money to MS when you can download a freeware suite that does the same thing and stick it to the man in Redmond) this malware exploit is totally and completely useless more than it is remote.

Jan 29, 2016 9:19 AM in response to JimmyCMPIT

back to the issue at hand and what I think I've done to fix my issue.


I issued another SMC reset this morning, my main account was still broke after this however.

So, I decided to attempt launching the Guest User safari session, that worked fine.

Thinking that was working and a good sign, I dropped into one of my backup accounts that I hardly ever use, but have in place as a fallback.

That account was OK, I could see applications, open up terminal/ect.

From there I removed Clam and restarted the MBP.


I logged back into my main account and while I still had all of the "application not found icons" on the dock, I was able to open each one.

Once opened the icon would return.


So, I'm not sure what fixed the issue.... the SMC reset or the removal of ClamxAV.

I'm 99% sure it was the removal of Clam, given I had done SMC and pram resets immediately.

It could've been walking the file system from the backup account....

Either way, I'm back to full performance but will be making a quick backup and doing a clean build of 10.11 this weekend just the same.

Feb 16, 2016 6:33 AM in response to docgoku

I had this exact same issue. My regular user account had bad application icons. Applications could not be launched using any of the normal methods. Logging into my admin' account (regular one is just a user for better security...) everything worked fine. I tried the SMC reset, PRAM reset and ClamAV removal. No joy.


While logged in as my regular user account, inadvertently, I double clicked on an HTML file and FireFox (my default browser) launched normally. It was slow to launch, but it launched normally. That continued to confirm that the fundamentals were all still there in the system and for this user. I started looking for linkage, directory, listing or similar types of problems and solutions.


Eventually, I stumbled across threads that talked about the /private/var/folders directory. The following links give you an idea, but you should do your own research:


http://apple.stackexchange.com/questions/209266/el-capitan-private-var-folders-c ache-files-consuming-30-40-gb

http://www.magnusviri.com/OS_X_Admin/what-is-var-folders.html

https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man7/hier.7.html


I had changed my regular user temporarily to an admin' account. I closed all open applications. I navigated to the /Private/Var/Folders directory. I deleted everything EXCEPT the zz/ directory. (Yes, my DOS roots are showing, but using the word folders to talk about a folder named folders is awkward.) The final step was doing a Shutdown (not logout, sleep or otherwise.) When I logged back in, EVERYTHING was back! Subjectively, the machine seemed more snappy (faster.) It was certainly faster than the broken and lost Applications state. For my own security conscience, I reinstalled ClamAV,logged out, logged in to the proper admin account, set the regular user back to just a user, did another shutdown and finally logged back in to the normal user account.


It's all back the way it should be. No rebuild required. The circumstances of the failure were likely caused by a conflict of the 10.11.3 patch and ClamAV. The fix is straightforward, once you know what to do. I hope this helps others.

OSX 10.11.3 Update - All Applications Gone - Safe boot as well

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.