MacOS – Repeated Kernel Panic

kernel-panicmacbook promacos

Can anyone decipher this, I've been having repeated Kernel Panics for a few months now. I spent the weekend wiping my drive and reinstalling the OS and upgrading to Sierra. Not 20 minutes after everything was completely reinstalled, I experienced another Kernel Panic and then again a 1/2 hr later. Here's the log:

nonymous UUID:       CE7C1640-C1E9-1D90-3416-FC8D0D0A8F87


Sun Nov  6 18:58:16 2016

*** Panic Report ***
panic(cpu 0 caller 0xffffff80238065ea): Kernel trap at 0xffffff80237244b4, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x0000000000000022, CR3: 0x00000003a920b0d9, CR4: 0x00000000001626e0
RAX: 0x0000000000000022, RBX: 0x0000000000000022, RCX: 0x0000000001000000, RDX: 0xffffff920e533eb8
RSP: 0xffffff920e533e90, RBP: 0xffffff920e533e90, RSI: 0xffffff920e533ec7, RDI: 0xffffff920e533eb4
R8:  0xffffff805354ec90, R9:  0xffffff80568db2b0, R10: 0x000070000291fcb0, R11: 0xffffff80568db2b0
R12: 0xffffff8055c64000, R13: 0x00000029e8d60800, R14: 0xffffff80568db2b0, R15: 0xffffff80568db232
RFL: 0x0000000000010286, RIP: 0xffffff80237244b4, CS:  0x0000000000000008, SS:  0x0000000000000010
Fault CR2: 0x0000000000000022, Error code: 0x0000000000000002, Fault CPU: 0x0, PL: 0

Backtrace (CPU 0), Frame : Return Address
0xffffff920e533b20 : 0xffffff80236f368c
0xffffff920e533ba0 : 0xffffff80238065ea
0xffffff920e533d80 : 0xffffff80236a5743
0xffffff920e533da0 : 0xffffff80237244b4
0xffffff920e533e90 : 0xffffff80236fff45
0xffffff920e533ef0 : 0xffffff80236ed01b
0xffffff920e533f20 : 0xffffff8023806eae
0xffffff920e533f40 : 0xffffff80236a570f

BSD process name corresponding to current thread: DesktopServicesH

Mac OS version:
16B2657

Kernel version:
Darwin Kernel Version 16.1.0: Wed Oct 19 20:31:56 PDT 2016; root:xnu-3789.21.4~4/RELEASE_X86_64
Kernel UUID: 75CA1C4D-7BF4-321B-B544-D8F1B6D60EF8
Kernel slide:     0x0000000023400000
Kernel text base: 0xffffff8023600000
__HIB  text base: 0xffffff8023500000
System model name: MacBookPro9,2 (Mac-6F01561E16C75D06)

System uptime in nanoseconds: 1896961583645
last loaded kext at 1793361934140: com.apple.driver.AppleXsanScheme 3 (addr 0xffffff7fa6019000, size 32768)
last unloaded kext at 1247388045086: com.apple.driver.DiskImages.KernelBacked 444.20.3 (addr 0xffffff7fa49ad000, size 77824)
loaded kexts:
com.apple.driver.AppleUSBStorageCoexistentDriver 404.20.1
com.apple.filesystems.smbfs 3.1
com.apple.driver.AudioAUUC 1.70
com.apple.driver.pmtelemetry 1
com.apple.iokit.IOUserEthernet 1.0.1
com.apple.iokit.IOBluetoothSerialManager 5.0.1f7
com.apple.driver.AGPM 110.23.11
com.apple.driver.X86PlatformShim 1.0.0
com.apple.Dont_Steal_Mac_OS_X 7.0.0
com.apple.driver.AppleGraphicsDevicePolicy 3.13.74
com.apple.driver.AppleUpstreamUserClient 3.6.4
com.apple.driver.AppleMikeyHIDDriver 127
com.apple.driver.AppleIntelHD4000Graphics 10.2.0
com.apple.driver.AppleHDA 278.23
com.apple.driver.AppleMikeyDriver 278.23
com.apple.driver.AppleOSXWatchdog 1
com.apple.driver.AppleHV 1
com.apple.driver.AppleBacklight 170.9.10
com.apple.driver.AppleThunderboltIP 3.0.8
com.apple.driver.AppleSMCPDRC 1.0.0
com.apple.iokit.AppleBCM5701Ethernet 10.2.6
com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 5.0.1f7
com.apple.driver.AppleSMCLMU 208
com.apple.driver.AppleLPC 3.1
com.apple.driver.AirPort.Brcm4360 1110.4.1a8
com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0
com.apple.driver.AppleMCCSControl 1.2.13
com.apple.driver.AppleIntelFramebufferCapri 10.2.0
com.apple.driver.SMCMotionSensor 3.0.4d1
com.apple.filesystems.autofs 3.0
com.apple.driver.AppleIRController 338
com.apple.driver.AppleUSBTCButtons 251
com.apple.driver.AppleUSBTCKeyboard 251
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0
com.apple.BootCache 40
com.apple.filesystems.hfs.kext 366.1.1
com.apple.iokit.SCSITaskUserClient 394
com.apple.iokit.IOAHCIBlockStorage 295.20.1
com.apple.driver.AppleFWOHCI 5.5.5
com.apple.driver.AppleSDXC 1.7.6
com.apple.driver.AppleAHCIPort 326
com.apple.driver.AppleSmartBatteryManager 161.0.0
com.apple.driver.AppleACPIButtons 5.0
com.apple.driver.AppleRTC 2.0
com.apple.driver.AppleHPET 1.8
com.apple.driver.AppleSMBIOS 2.1
com.apple.driver.AppleACPIEC 5.0
com.apple.driver.AppleAPIC 1.7
com.apple.driver.AppleIntelCPUPowerManagementClient 219.0.0
com.apple.nke.applicationfirewall 172
com.apple.security.quarantine 3
com.apple.security.TMSafetyNet 8
com.apple.driver.AppleIntelCPUPowerManagement 219.0.0
com.apple.driver.AppleXsanScheme 3
com.apple.iokit.IOSCSIBlockCommandsDevice 394
com.apple.iokit.IOUSBMassStorageClass 4.0.4
com.apple.iokit.IOUSBMassStorageDriver 131.1.1
com.apple.driver.usb.cdc 5.0.0
com.apple.iokit.IOSerialFamily 11
com.apple.driver.AppleSSE 1.0
com.apple.iokit.IOSurface 153.1
com.apple.driver.DspFuncLib 278.23
com.apple.kext.OSvKernDSPLib 525
com.apple.iokit.IOEthernetAVBController 1.0.3b4
com.apple.iokit.IOBluetoothHostControllerUSBTransport 5.0.1f7
com.apple.iokit.IOBluetoothHostControllerTransport 5.0.1f7
com.apple.iokit.IOBluetoothFamily 5.0.1f7
com.apple.iokit.IOFireWireIP 2.2.7
com.apple.driver.AppleHDAController 278.23
com.apple.iokit.IOHDAFamily 278.23
com.apple.iokit.IOAudioFamily 205.11
com.apple.vecLib.kext 1.2.0
com.apple.kec.Libm 1
com.apple.driver.AppleSMBusPCI 1.0.14d1
com.apple.driver.AppleBacklightExpert 1.1.0
com.apple.iokit.IONDRVSupport 2.4.1
com.apple.driver.AppleGraphicsControl 3.13.74
com.apple.iokit.IO80211Family 1200.12.2
com.apple.driver.mDNSOffloadUserClient 1.0.1b8
com.apple.driver.corecapture 1.0.4
com.apple.driver.X86PlatformPlugin 1.0.0
com.apple.driver.IOPlatformPluginFamily 6.0.0d8
com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0
com.apple.driver.AppleSMBusController 1.0.14d1
com.apple.iokit.IOAcceleratorFamily2 288.15
com.apple.AppleGraphicsDeviceControl 3.13.74
com.apple.iokit.IOGraphicsFamily 2.4.1
com.apple.driver.AppleSMC 3.1.9
com.apple.kext.triggers 1.0
com.apple.driver.AppleUSBMultitouch 258
com.apple.driver.usb.IOUSBHostHIDDevice 1.1
com.apple.driver.usb.networking 5.0.0
com.apple.driver.usb.AppleUSBHostCompositeDevice 1.1
com.apple.driver.usb.AppleUSBHub 1.1
com.apple.driver.CoreStorage 540
com.apple.iokit.IONetworkingFamily 3.2
com.apple.filesystems.hfs.encodings.kext 1
com.apple.iokit.IOSCSIMultimediaCommandsDevice 394
com.apple.iokit.IOBDStorageFamily 1.8
com.apple.iokit.IODVDStorageFamily 1.8
com.apple.iokit.IOCDStorageFamily 1.8
com.apple.driver.AppleThunderboltDPInAdapter 4.5.5
com.apple.driver.AppleThunderboltDPAdapterFamily 4.5.5
com.apple.driver.AppleThunderboltPCIDownAdapter 2.0.5
com.apple.iokit.IOAHCISerialATAPI 266
com.apple.iokit.IOSCSIArchitectureModelFamily 394
com.apple.driver.AppleThunderboltNHI 4.1.6
com.apple.iokit.IOThunderboltFamily 6.2.3
com.apple.iokit.IOFireWireFamily 4.6.4
com.apple.iokit.IOAHCIFamily 288
com.apple.driver.usb.AppleUSBEHCIPCI 1.1
com.apple.driver.usb.AppleUSBEHCI 1.1
com.apple.driver.usb.AppleUSBXHCIPCI 1.1
com.apple.driver.usb.AppleUSBXHCI 1.1
com.apple.driver.usb.AppleUSBHostPacketFilter 1.0
com.apple.iokit.IOUSBFamily 900.4.1
com.apple.driver.AppleEFINVRAM 2.1
com.apple.driver.AppleUSBHostMergeProperties 1.1
com.apple.driver.AppleEFIRuntime 2.0
com.apple.iokit.IOHIDFamily 2.0.0
com.apple.iokit.IOSMBusFamily 1.1
com.apple.security.sandbox 300.0
com.apple.kext.AppleMatch 1.0.0d1
com.apple.driver.AppleKeyStore 2
com.apple.driver.AppleMobileFileIntegrity 1.0.5
com.apple.driver.AppleCredentialManager 1.0
com.apple.driver.KernelRelayHost 1
com.apple.iokit.IOUSBHostFamily 1.1
com.apple.driver.AppleBusPowerController 1.0
com.apple.driver.DiskImages 444.20.3
com.apple.iokit.IOStorageFamily 2.1
com.apple.iokit.IOReportFamily 31
com.apple.driver.AppleFDEKeyStore 28.30
com.apple.driver.AppleACPIPlatform 5.0
com.apple.iokit.IOPCIFamily 2.9
com.apple.iokit.IOACPIFamily 1.4
com.apple.kec.pthread 1
com.apple.kec.corecrypto 1.0
Model: MacBookPro9,2, BootROM MBP91.00D3.B0D, 2 processors, Intel Core i5, 2.5 GHz, 16 GB, SMC 2.2f41
Graphics: Intel HD Graphics 4000, Intel HD Graphics 4000, Built-In
Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1333 MHz, 0x04CD, 0x46412D3133333343392D3847535100000020
Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1333 MHz, 0x04CD, 0x46412D3133333343392D3847535100000020
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0xF5), Broadcom BCM43xx 1.0 (7.21.171.47.1a8)
Bluetooth: Version 5.0.1f7, 3 services, 27 devices, 1 incoming serial ports
Network Service: Wi-Fi, AirPort, en1
Serial ATA Device: APPLE HDD HTS547550A9E384, 500.11 GB
Serial ATA Device: MATSHITADVD-R   UJ-8A8
USB Device: USB 2.0 Bus
USB Device: Hub
USB Device: FaceTime HD Camera (Built-in)
USB Device: USB 2.0 Bus
USB Device: Hub
USB Device: Hub
USB Device: Apple Internal Keyboard / Trackpad
USB Device: IR Receiver
USB Device: BRCM20702 Hub
USB Device: Bluetooth USB Host Controller
USB Device: USB 3.0 Bus
USB Device: My Passport 0748
USB Device: G Mouse
Thunderbolt Bus: MacBook Pro, Apple Inc., 25.1

Best Answer

Hi I don't really think it's the ram I have a 2011 MacBook Pro and it runs 16gb easily and I'm pretty sure you can even put in 32. I think you have malware on your computer. Your darwin kernel version is 16.1.0 but dated Oct 19. I'm pretty sure the authentic 16.1.0 is dated Oct 13.

Also a number of those kext are likely malware and linked to a mach rootkit. Your system would prevent from loading in safe mode. You can boot into single user verbose minimum boot and if you look closely at the output that probably will be pushed off screen quickly to see it block them.

You can do this by: - entering recovery mode (command R at startup) - opening the terminal - nvram -p (to see your nvram configuration) - nvram -c (to purge the nvram configuration) - nvram boot-args="-x -s -v debug=0x14e cpus=1 -no-zp=1" (to get your computer to boot into single verbose safe boot on one cpu in debug) - reboot - read the output from single user-I use my iphone camera on slow motion to get what it says since it all disapears really quickly. You can try taking of the cpus=1 or changing to a different cpus 0-3 or 0-7 depending if your processor is quad (8 total for quad, 4 for dual) - when you're done with all that nvram -c again to reset boot-args/nvram - reboot

Also I would check the volumes you have mounted with diskutil list if you see 15-18 you need to run hdiutil imageinfo -debug to check if they're being saved as ramfiles (definitely malware related) the image path will look like ramfile:///[####] or ram:///[####]. I don't think you'll have that issue though on that computer

As for removing anything I'm not sure where this thing has a foothold but it's a pain to remove and Apple's solution has just been to give the person a new computer if the computer still has applecare in the cases I've heard others talking about. I think it's messes with the EFI in some way making it nearly impossible to actually delete and reinstalling the OS from recovery mode will show an 'unknown' process which starts doing all the questionable stuff in the installer log. Apple has been less than useful and this stuff goes over AppleCare call center reps' heads (there's thousands and thousands of them probably averaging 4 months on the job with almost no actual expertise and many don't even own a Mac).