Can't delete Evernote's ENSDKResources.bundle

Question

Adonsa Author

Level 1

15 points

Can't delete Evernote's ENSDKResources.bundle

Hi,

Former Evernote User. I "unstalled" Evernote back in the System Mojave days, or so I thought.

Evernote left behind a file called ENSDKResources.bundle which it had planted into the,

/System/iOSSupport/System/Library/PrivateFrameworks/ActionKit.framework/Versions/A/Resources

directory.

Under System Sequoia, something spawned an additional occurrence of ENSDKResources.bundle.

Over time, upgrading thru Systems Monterrey, Ventura, Sonoma, and on to Sequoia, Evernote's ENSDKResources.bundle spawned every time.

ENSDKResources.bundle permissions cannot be changed. My attempts to give it write permissions and deleted it failed, even though I had,

SIP disabled

Booted as root in Safe Mode

The nasty "The operation can't be completed because you don't have the necessary permissions." error occurred even though I was ROOT !!!

Even the Batchmod application couldn't change ENSDKResources.bundle 's permissions.

When I did a clean install to System Sequoia I backed up the internal drive to an external, and, from that external backup drive, I deleted every occurrence of scattered Evernote files. The insidious ENSDKResources.bundle was not on my backup volume but many reminents of Evernote were there and I deleted them. Then I erased the internal, performed clean System Sequoia install. Next I did a migration-assistant migration from the same source drive that I previously deleted all Evernote files from.

After completion, I discovered that ENSDKResources.bundle respawned in 2 locations. It spawned on its on.

Is it malware? I dunno.

It's going to be correctly argued that it's impossible to change System folder contents. The question becomes, "how, then, did Evernote programmers write code that would plant persistent files into System Folder?" Evernote put ENSDKResources.bundle there, but permission changes and subsequent removal are not allowed.

Every now and then new Evernote related files and folders spawn on their on and are strewed around in the System Folder; I can delete them but not the nasty ENSDKResources.bundle .

My email to the Evernote Corporation was not answered.

Any advice, will be most graciously appreciated.

Thanks very much!

Posted on Sep 1, 2025 05:47 PM

Reply

Answer 1

HWTech

Level 9

66,758 points

Sep 1, 2025 06:03 PM in response to Adonsa

That location is within the signed & sealed & locked read-only system volume......it is impossible to touch anything at that location these days.

Perform a clean install of macOS by first erasing the disk followed by reinstalling macOS. If you choose to restore from a Time Machine backup, then make sure to uncheck "Applications" and "Settings" options and perhaps even "Other" (I have no idea what is included in that category). By restoring only your home user folder(s), you should not be restoring anything else so that should resolve your problem.

Reply

Answer 2

Adonsa Author

Level 1

15 points

Sep 1, 2025 06:26 PM in response to HWTech

Hi HWTech, and thanks for quick reply. I'm not surprised.

It's still rather curious as to how Evernote application installed files into the locked system folder.

I'll have to do a cleaner install than what I did before.

Thanks again!

Reply

Answer 3

John Galt

Level 10

153,610 points

Sep 1, 2025 06:45 PM in response to Adonsa

Adonsa wrote:

It's still rather curious as to how Evernote application installed files into the locked system folder.

The problem you face is that certain well-known system extensions (Evernote among them) were permitted to remain in place, "grandfathered" so to speak, during the gradual transition to more the recent macOS's signed and cryptographically sealed system volume. That system extension / kernel extension will remain, locked in place, presumably forever.

SIP disabled

Booted as root in Safe Mode

Doesn't matter. In the past it was difficult to alter macOS; now it is quite literally impossible.

Since they had the ability to introduce vulnerabilities I suspect, though I am not 100% certain, that those "permissible" legacy system extensions were laboriously hand-picked.

Apple warned us they were going away several macOS versions ago (2019). They are now completely blocked.

References:

About system extensions and macOS - Apple Support

As for the Evernote app itself, I had used it a while ago, but as I recall they suffered some kind of security breach a decade or so ago that was alleged to have exposed user data. To their credit they acknowledged the breach. I uninstalled it and never looked back.

Reply