PulseSecure crashes macOS 10.13.5

Question

Level 1

4 points

PulseSecure crashes macOS 10.13.5

Due to business requirements, I installed Pulse Secure in my Macbook Pro Retina 13" Early 2015 running macOS 10.13.5 and it started crashing with Black Screen of death. No warnings and macbook restarts and looses all data.

I deleted the app completely via AppCleaner and installed in Windows 10 running in Parallels 13.3.0 Business Edition. Even after that I am experiencing BSOD every now and then. After the reboot the Problem report for MacOS showed and up I copied the tech info in a text document to share here. I am not that technical to understand but just want to know if this is happening due to Pulse Secure running in Windows or some files are still left in MacOS crashing the OS completely.

Anonymous UUID: 40F42A71-8D87-5232-5827-318B3062640F

Tue Jun 26 17:05:36 2018

*** Panic Report ***

panic(cpu 1 caller 0xffffff800cd87d3d): Kernel trap at 0xffffff800d211c18, type 13=general protection, registers:

CR0: 0x0000000080010033, CR2: 0x00007ffee5609fb0, CR3: 0x0000000251b27030, CR4: 0x00000000003627e0

RAX: 0x0069562c0069562c, RBX: 0xffffff7f8d6f6088, RCX: 0x000000002648d401, RDX: 0xffffff9146b2bd20

RSP: 0xffffff9146b2bd20, RBP: 0xffffff9146b2bd30, RSI: 0xffffff7f8d6f6088, RDI: 0xffffff802648d480

R8: 0xffffff800d49b7d0, R9: 0x0000000000000000, R10: 0x0000000000000000, R11: 0x0000000000000000

R12: 0xffffff7f8d6f6088, R13: 0xffffff80318ed868, R14: 0xffffff802648d480, R15: 0xffffff8031e32d20

RFL: 0x0000000000010282, RIP: 0xffffff800d211c18, CS: 0x0000000000000008, SS: 0x0000000000000010

Fault CR2: 0x00007ffee5609fb0, Error code: 0x0000000000000000, Fault CPU: 0x1, PL: 0, VF: 0

Backtrace (CPU 1), Frame : Return Address

0xffffff800cb4ca70 : 0xffffff800cc6d166

0xffffff800cb4cac0 : 0xffffff800cd95824

0xffffff800cb4cb00 : 0xffffff800cd87b10

0xffffff800cb4cb80 : 0xffffff800cc1f180

0xffffff800cb4cba0 : 0xffffff800cc6cbdc

0xffffff800cb4ccd0 : 0xffffff800cc6c99c

0xffffff800cb4cd30 : 0xffffff800cd87d3d

0xffffff800cb4ceb0 : 0xffffff800cc1f180

0xffffff800cb4ced0 : 0xffffff800d211c18

0xffffff9146b2bd30 : 0xffffff7f8d6ec700

0xffffff9146b2bd70 : 0xffffff7f8d6ed08b

0xffffff9146b2bda0 : 0xffffff7f8d6eceee

0xffffff9146b2bdb0 : 0xffffff800d19c432

0xffffff9146b2bdf0 : 0xffffff800d19c81d

0xffffff9146b2be20 : 0xffffff800d1735f3

0xffffff9146b2be80 : 0xffffff800d184be3

0xffffff9146b2bf00 : 0xffffff800d184a93

0xffffff9146b2bf40 : 0xffffff800d20386f

0xffffff9146b2bfa0 : 0xffffff800cc1f655

Kernel Extensions in backtrace:

net.pulsesecure.PulseSecureFirewall(9.0.1f2)[5DE2E181-7330-35C0-9EE0-C930DC281B 3D]@0xffffff7f8d6ea000->0xffffff7f8d6f6fff

BSD process name corresponding to current thread: vpnagentd

Mac OS version:

17F77

Kernel version:

Darwin Kernel Version 17.6.0: Tue May 8 15:22:16 PDT 2018; root:xnu-4570.61.1~1/RELEASE_X86_64

Kernel UUID: CC1699EE-71B5-3AF1-AAA3-6DBD16222B92

Kernel slide: 0x000000000ca00000

Kernel text base: 0xffffff800cc00000

__HIB text base: 0xffffff800cb00000

System model name: MacBookPro12,1 (Mac-E43C1C25D4880AD6)

System uptime in nanoseconds: 15779441012644

last loaded kext at 15766284589374: com.apple.driver.AppleMikeyHIDDriver 131 (addr 0xffffff7f901d9000, size 16384)

last unloaded kext at 15546681040175: com.apple.driver.AppleMikeyHIDDriver 131 (addr 0xffffff7f901d2000, size 8192)

loaded kexts:

com.parallels.kext.vnic 13.3.0 43321

com.parallels.kext.netbridge 13.3.0 43321

com.parallels.kext.hypervisor 13.3.0 43321

com.cisco.kext.acsock 4.5.0

com.paragon-software.filesystems.ntfs 319.2.15

net.pulsesecure.PulseSecureFirewall 9.0.1f2

com.apple.driver.AppleMikeyHIDDriver 131

com.apple.filesystems.smbfs 3.2.3

com.apple.filesystems.autofs 3.0

com.apple.driver.AudioAUUC 1.70

com.apple.driver.AppleHWSensor 1.9.5d0

com.apple.driver.X86PlatformShim 1.0.0

com.apple.driver.AGPM 110.23.37

com.apple.driver.ApplePlatformEnabler 2.7.0d0

com.apple.driver.AppleUpstreamUserClient 3.6.5

com.apple.driver.AppleHDA 281.52

com.apple.driver.AppleGraphicsDevicePolicy 3.18.52

com.apple.AGDCPluginDisplayMetrics 3.18.52

com.apple.driver.AppleHV 1

com.apple.driver.AppleIntelBDWGraphics 10.3.4

com.apple.iokit.IOUserEthernet 1.0.1

com.apple.iokit.IOBluetoothSerialManager 6.0.6f2

com.apple.driver.pmtelemetry 1

com.apple.Dont_Steal_Mac_OS_X 7.0.0

com.apple.driver.AppleThunderboltIP 3.1.1

com.apple.driver.eficheck 1

com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0

com.apple.driver.AppleIntelBDWGraphicsFramebuffer 10.3.4

com.apple.iokit.BroadcomBluetooth20703USBTransport 6.0.6f2

com.apple.driver.AppleLPC 3.1

com.apple.driver.AppleCameraInterface 6.01.2

com.apple.driver.AppleSMCLMU 211

com.apple.driver.AppleBacklight 170.12.6

com.apple.driver.AppleMCCSControl 1.5.5

com.apple.driver.AppleOSXWatchdog 1

com.apple.driver.AppleUSBCardReader 439.60.2

com.apple.filesystems.hfs.kext 407.50.6

com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1

com.apple.BootCache 40

com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0

com.apple.AppleSystemPolicy 1.0

com.apple.filesystems.apfs 748.51.0

com.apple.driver.AppleAHCIPort 329.50.2

com.apple.driver.AppleTopCaseHIDEventDriver 133

com.apple.driver.AirPort.BrcmNIC 1241.31.1a9

com.apple.driver.AppleHPET 1.8

com.apple.driver.AppleSmartBatteryManager 161.0.0

com.apple.driver.AppleACPIButtons 6.1

com.apple.driver.AppleRTC 2.0

com.apple.driver.AppleSMBIOS 2.1

com.apple.driver.AppleACPIEC 6.1

com.apple.driver.AppleAPIC 1.7

com.apple.nke.applicationfirewall 183

com.apple.security.TMSafetyNet 8

com.apple.security.quarantine 3

com.apple.driver.usb.cdc 5.0.0

com.apple.kext.triggers 1.0

com.apple.driver.DspFuncLib 281.52

com.apple.kext.OSvKernDSPLib 526

com.apple.driver.AppleGraphicsControl 3.18.52

com.apple.iokit.IOAVBFamily 680.2

com.apple.plugin.IOgPTPPlugin 680.15

com.apple.iokit.IOEthernetAVBController 1.1.0

com.apple.driver.AppleSSE 1.0

com.apple.iokit.IOSerialFamily 11

com.apple.AppleGPUWrangler 3.18.52

com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0

com.apple.AppleGraphicsDeviceControl 3.18.52

com.apple.iokit.IOAcceleratorFamily2 378.18.1

com.apple.iokit.IOSurface 211.12

com.apple.driver.AppleHDAController 281.52

com.apple.iokit.IOHDAFamily 281.52

com.apple.iokit.IOAudioFamily 206.5

com.apple.vecLib.kext 1.2.0

com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 6.0.6f2

com.apple.iokit.IOBluetoothHostControllerUSBTransport 6.0.6f2

com.apple.iokit.IOBluetoothHostControllerTransport 6.0.6f2

com.apple.driver.AppleBacklightExpert 1.1.0

com.apple.iokit.IONDRVSupport 519.19

com.apple.driver.AppleSMBusController 1.0.18d1

com.apple.iokit.IOGraphicsFamily 519.19

com.apple.driver.X86PlatformPlugin 1.0.0

com.apple.driver.IOPlatformPluginFamily 6.0.0d8

com.apple.driver.usb.networking 5.0.0

com.apple.driver.usb.AppleUSBHostCompositeDevice 1.2

com.apple.filesystems.hfs.encodings.kext 1

com.apple.iokit.IOAHCIBlockStorage 301.40.2

com.apple.driver.AppleThunderboltDPInAdapter 5.5.4

com.apple.driver.AppleThunderboltDPAdapterFamily 5.5.4

com.apple.driver.AppleThunderboltPCIDownAdapter 2.1.3

com.apple.iokit.IOAHCIFamily 288

com.apple.driver.AppleActuatorDriver 1404.4

com.apple.driver.AppleHIDKeyboard 205

com.apple.driver.AppleHSBluetoothDriver 133

com.apple.driver.IOBluetoothHIDDriver 6.0.6f2

com.apple.iokit.IOBluetoothFamily 6.0.6f2

com.apple.driver.AppleMultitouchDriver 1404.4

com.apple.driver.AppleInputDeviceSupport 1404.3

com.apple.driver.AppleHSSPIHIDDriver 53

com.apple.driver.AppleThunderboltNHI 4.7.2

com.apple.iokit.IOThunderboltFamily 6.7.8

com.apple.iokit.IO80211Family 1200.12.2

com.apple.driver.mDNSOffloadUserClient 1.0.1b8

com.apple.driver.corecapture 1.0.4

com.apple.driver.AppleHSSPISupport 53

com.apple.driver.usb.AppleUSBHostPacketFilter 1.0

com.apple.iokit.IOUSBFamily 900.4.1

com.apple.driver.AppleIntelLpssSpiController 3.0.60

com.apple.driver.AppleUSBHostMergeProperties 1.2

com.apple.driver.AppleIntelLpssDmac 3.0.60

com.apple.driver.AppleIntelLpssGspi 3.0.60

com.apple.driver.usb.AppleUSBXHCIPCI 1.2

com.apple.driver.usb.AppleUSBXHCI 1.2

com.apple.driver.AppleEFINVRAM 2.1

com.apple.driver.AppleEFIRuntime 2.1

com.apple.iokit.IOHIDFamily 2.0.0

com.apple.iokit.IOSMBusFamily 1.1

com.apple.security.sandbox 300.0

com.apple.kext.AppleMatch 1.0.0d1

com.apple.driver.DiskImages 480.60.1

com.apple.driver.AppleFDEKeyStore 28.30

com.apple.driver.AppleEffaceableStorage 1.0

com.apple.driver.AppleKeyStore 2

com.apple.driver.AppleUSBTDM 439.60.2

com.apple.driver.AppleMobileFileIntegrity 1.0.5

com.apple.iokit.IOUSBMassStorageDriver 140.50.3

com.apple.iokit.IOSCSIBlockCommandsDevice 404.30.2

com.apple.iokit.IOSCSIArchitectureModelFamily 404.30.2

com.apple.iokit.IOStorageFamily 2.1

com.apple.driver.AppleCredentialManager 1.0

com.apple.driver.KernelRelayHost 1

com.apple.iokit.IOUSBHostFamily 1.2

com.apple.driver.usb.AppleUSBCommon 1.0

com.apple.driver.AppleBusPowerController 1.0

com.apple.driver.AppleSEPManager 1.0.1

com.apple.driver.IOSlaveProcessor 1

com.apple.iokit.IOReportFamily 31

com.apple.iokit.IOTimeSyncFamily 680.15

com.apple.iokit.IONetworkingFamily 3.4

com.apple.driver.AppleACPIPlatform 6.1

com.apple.driver.AppleSMC 3.1.9

com.apple.iokit.IOPCIFamily 2.9

com.apple.iokit.IOACPIFamily 1.4

com.apple.kec.pthread 1

com.apple.kec.Libm 1

com.apple.kec.corecrypto 1.0

EOF

Model: MacBookPro12,1, BootROM MBP121.0176.B00, 2 processors, Intel Core i5, 2.9 GHz, 8 GB, SMC 2.28f7

Graphics: Intel Iris Graphics 6100, Intel Iris Graphics 6100, Built-In

Memory Module: BANK 0/DIMM0, 4 GB, DDR3, 1867 MHz, 0x80CE, 0x4B3445364533303445452D45474346000000

Memory Module: BANK 1/DIMM0, 4 GB, DDR3, 1867 MHz, 0x80CE, 0x4B3445364533303445452D45474346000000

AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x133), Broadcom BCM43xx 1.0 (7.77.37.31.1a9)

Bluetooth: Version 6.0.6f2, 3 services, 27 devices, 1 incoming serial ports

Network Service: Wi-Fi, AirPort, en0

Serial ATA Device: APPLE SSD SM0512G, 500.28 GB

USB Device: USB 3.0 Bus

USB Device: Internal Memory Card Reader

USB Device: Bluetooth USB Host Controller

Thunderbolt Bus: MacBook Pro, Apple Inc., 27.1

MacBook Pro with Retina display, macOS High Sierra (10.13.5), null

Posted on Jun 26, 2018 8:33 AM

Reply

Answer 1

Best reply

Grant Bennet-Alder

Level 10

126,979 points

Jun 27, 2018 9:21 AM in response to Akhil Abrol

copy and paste the string below into: Finder > Go Menu > Go to Folder

/Library/Extensions

This folder should contain the offending extension. You can MOVE (including TO the Trash) but not delete, items that are currently part of MacOS. Once you do a Restart, the item will no longer be part of MacOS and can be removed from your Mac by emptying the Trash.

If the package from Symantec includes so-called Anti-Virus scanning (they are ALL a sham, but that does not seem to slow them down, they only slow the performance of your Mac and make it crash on False Alarms) you will have similar problems with it eventually.

Reply

Answer 2

Old Toad

Level 10

207,361 points

Jun 27, 2018 10:05 AM in response to Akhil Abrol

Download and run Etrecheck. Copy and paste the results into your reply. Etrecheck is a diagnostic tool that was developed by one of the most respected users here in the ASC and recommended by Apple Support to provide a snapshot of the system and help identify the more obvious culprits that can adversely affect a Mac's performance.

This will let you know if there are any residual files associated with Symantec in your system.

Reply

Answer 3

Akhil Abrol Author

Level 1

4 points

Jun 26, 2018 11:38 PM in response to Grant Bennet-Alder

I searched that before using AppCleaner. The developer site says:

For Macintosh OSX:

Delete the folder

<home_dir>/Library/Logs/Juniper Networks

Delete the following files from the <

home_dir>/Library/Application Support/Juniper Networks/ folder:

hostchecker.jar

hcport.txt
preauthCookie.txt

Empty the Trash

I work in IBM and this is IBM provided Macbook. I can install Symantec Antivirus which is licensed for this Macbook.

The tech support at IBM says I must reinstall the complete OS which I do not want at all. With my very limited and little knowledge I believe the below log has something to do with the crash

Kernel Extensions in backtrace:

net.pulsesecure.PulseSecureFirewall(9.0.1f2)[5DE2E181-7330-35C0-9EE0-C930DC281B 3D]@0xffffff7f8d6ea000->0xffffff7f8d6f6fff

Is there anyway I can delete this to stop kernel panic?

Reply

Answer 4

Jun 26, 2018 9:28 AM in response to Akhil Abrol

I deleted the app completely via AppCleaner

You MUST use the developer's uninstaller. Third party cleaner Apps just look for similar names, and your panic report shows it did not guess adequately -- there is at least one piece still installed, and it directly caused that kernel panic.

If you employers or schools say you MUST use anti-Virus software on your Mac, consider MalwareBytes. If that is not adequate, use ClamXAV, but have it scan ONCE (on demand) and stop.

Reply

Answer 5

Akhil Abrol Author

Level 1

4 points

Jun 27, 2018 2:05 AM in response to Akhil Abrol

Since morning there are 5 restarts in 3 hours. Loosing data every time now.

I installed Symantec Endpoint Protection and it did not showed any malware or spyware. My worry is, this is not a malware issue. It looks like the PulseSecure (VPN Client) has compatibility issues with macOS and developer has to fix it. Not just me, but the other guy running Pulse Secure in MacOS is also complaining the same.

I can install ClamXAV but wondering if it will resolve the issue. Pulse Secure is a VPN client and might not be considered as malware to clean.

Reply

Answer 6

Akhil Abrol Author

Level 1

4 points

Jun 27, 2018 9:24 AM in response to Grant Bennet-Alder

I saw the culprit in this extensions folder. PulseSecureFirewall.kext

I have moved it to Trash for now and hopefully this will solve the problem. I will report if it occurs again. Many thanks..

PS Removed that so called Symantec Antivirus.

Reply

Answer 7

Akhil Abrol Author

Level 1

4 points

Jun 27, 2018 10:45 AM in response to Old Toad

Ok I did as you instructed. It showed me Major issues that my Mac restarted due to Kernel Panic. And when I clicked on review report, it showed me exactly what I have pasted above. The extension as I mentioned was PulseSecure Firewall which I have already deleted as instructed by Grant Bennet. I believe the problem is solved. But in case if it isn't. I will report back.

Thanks a lot for helping out.

Reply