Trojan Hides In Pirated Copies of Apple iWork '09

CWmike writes "Pirated copies of Apple's new iWork '09 suite that are now available on file-sharing sites contain a Trojan horse that hijacks Macs and leaves them open to further attack, a security company said yesterday. The 'iServices.a' Trojan hitchhikes on iWork '09's installer, said Intego, which makes Mac security software. 'The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer's request of an administrator password,' Intego said in a warning. Once installed, the Trojan "phones home" to a malicious server to notify the hacker that the Mac has been compromised, and to await instructions."

Comments

Re:Nice of them to tell you how to remove it.

[nawcom]

Their alert, unlike every other antivirus company alert, does not tell you how to remove the trojan.

Nice.

sudo -s (enter password)
rm -r /System/Library/StartupItems/iWorkServices
rm /private/tmp/.iWorkServices
rm /usr/bin/iWorkServices
rm -r /Library/Receipts/iWorkServices.pkg
killall -9 iWorkServices