What to do when your Mac starts up all wrong

You may have started your Mac up at the beginning of the day, or just restarted it. The last time that you used it, everything seemed fine. But now it is running into problems: major functions, such as its network connection or peripherals, are not working properly, or not at all. Instead, when you try to do certain things, you see error messages which are unfamiliar.

How do you start trying to work out what is wrong, and how to fix it? Is it sudden hardware failure, a failed startup disk, malware, or what?

First, make a note of when your Mac was last started up or restarted, the rough time and date. This is potentially valuable information which you will use in the steps below.

Is it the result of a silent update?

Apple is pushing out more and more silent updates to various security components of OS X. On 26 February 2016, one such silent update, to the SIP feature which protects key system folders and files, disabled the kernel extension (KEXT) required by some models of Macs to access their built-in Ethernet ports. A fix was not rolled out for over two days.

Browse to /Library/Receipts/InstallHistory.plist, which lists all the updates that have been applied, and check at the end (using QuickLook) what has been installed since your Mac’s last startup. Look particularly for com.apple items, as those have originated from Apple. Any with a display name of Incompatible Kernel Extension Configuration Data are updates to SIP and related protection, and might have disabled a key KEXT.

applebrokensecupd
The Install History on my iMac reveals Apple’s silent and deadly update on 26 February, and the fixed version being installed just over two days later.

Next browse your logs using Console. Scroll back to the last startup, and then work your way down. Look for entries such as
com.apple.kextd[60]: Failed to load /System/Library/Extensions/*.kext
kernel[0]: Kext com.apple.* is in exclude list, not loadable

where * represents a kernel extension name, indicating that a key KEXT has been disabled.

logentrieskextsip

Following Apple’s instructions here will only fix the problem if Apple has already issued a fixed update. If that has not yet happened, you should be able to start your Mac up and use it again as follows.

  1. Restart in Recovery mode by holding down Command-R while your Mac starts up.
  2. Select Disk Utility from the list of OS X Utilities.
  3. Select your drive from the list of internal drives in the sidebar; its default name is Macintosh HD.
  4. If the drive name is dimmed, it is probably protected by FileVault. Choose File > Unlock from the Disk Utility menu, entering your FileVault password.
  5. If your drive is not yet mounted, choose File > Mount in Disk Utility to mount it.
  6. Quit Disk Utility.
  7. Choose Utilities > Terminal to open the Terminal app.
  8. Type or paste the following command as one line in Terminal, then press Return. Replace Macintosh HD with the name of your hard drive, if different: rm -rf "/Volumes/Macintosh HD/System/Library/Extensions/AppleKextExcludeList.kext"
  9. Quit Terminal.
  10. Choose Restart from the Apple menu. Once restarted, normal services should resume, although any subsequent restart risks losing the service again.

Do not restart or shut down your Mac after that until you know that Apple has issued a fixed update.

Is it the effect of malware?

Think back and consider whether you visited any websites which were suspicious, or downloaded software or updates from insecure sources, using HTTP rather than HTTPS, for example.

Although virus protection software may be able to detect this malware, do not rely on any claim that your Mac is clean, even if your virus definitions are up to date. You should consider using Objective-See’s software tools such as TaskExplorer.

Is it a problem with your startup volume?

Although Disk Utility can scan and repair your startup drive, it is much better to restart in Recovery mode and run Disk Utility from there, or even better to start up from a specially-prepared removable drive, such as a USB memory stick with OS X and any additional repair and recovery tools on it.

Did you install anything which could be causing a conflict?

Entries in /Library/Receipts/InstallHistory.plist can show these. If in any doubt, try restarting in Safe mode (Shift key held) and see if the problem vanishes.

Is it a hardware failure?

Most likely problems are in your Mac itself. To run Apple’s Diagnose or Hardware Test, restart with the D key held down; you will need a USB keyboard and mouse in most cases, as this does not support wireless mice, trackpads, or keyboards.

If that reports no faults, then problems could result from a peripheral. For example, a persistent error on an external hard drive used for Time Machine backups can cause a lot of crashes and altered behaviour. Eject and disconnect all external peripherals except those which are essential, such as mouse and keyboard.

Is it confined to App Store products?

If other apps work normally, but all (or most purchased) App Store products result in errors, suspect either:

  • your Mac’s hardware profile has changed, for example the MAC for its Ethernet port is missing; this makes it likely to be a KEXT problem, as above;
  • the App Store is suffering more general problems. In the past these have resulted from changes in security certificates, for example. Contact App Store support if possible, and search to see if others are reporting similar problems.

If at the end of all these you remain mystified, then you are back to general diagnostic procedures, described here.