SecureMac has released iWorkServices Trojan Removal Tool, a free
utility created to remove the iWorkServices Trojan from infected Macs
running OS X.
This tool is in response to a new trojan horse in the wild that
comes bundled with pirated copies of Apple’s iWork 09. Intego
recommends “users [do not] download iWork 09 installers from sites
offering pirated software (As of 6 am EST, at least 20,000 people
ha[d] downloaded this installer).”
When infected copies of the iWork 09 installer are run, they install
a hidden trojan program called iWorkServices with full access rights
to the target computer. Once the trojan is installed, it will
attempt to connect to a remote server and provide the server with
the infected computer’s network location. It then listens for
further instructions from the remote server, which may include
instructions to download additional components.
Users who feel they might be infected can use SecureMac’s free
removal tool to remove the trojan horse. The removal tool can be
downloaded by visiting SecureMac.com (http://www.securemac.com);
Intego’s security alert is available at Intego.com in the News
section.