Mac Trojan 001 - iWork '09 (Retail)

Inside a pirated copy of iWork '09 (Retail) is a slipstreamed package called "iWorkServices.pkg" which will install a trojan. Intego is calling it "OSX.Trojan.iServices.A".

Use Little Snitch all the time as even some legitimate copies of software (and iPods) have had viruses and Trojans on them. If you open the installer for iWork '09 Retail with a right-click and select Show Package Contents, and see within the Packages folder "iWorkServices.pkg" don't install that copy of iWork '09.

Someone has posted these instructions for removing the Trojan if you have already installed it.

It does not seem to be too complex. Just do the following to delete the crappy trojan:

1) (open Terminal.app)
2) sudo su (enter password)
3) rm -r /System/Library/StartupItems/iWorkServices
4) rm /private/tmp/.iWorkServices
5) rm /usr/bin/iWorkServices
6) rm -r /Library/Receipts/iWorkServices.pkg
7) killall -9 iWorkServices

This should disable any running processes of the trojan and delete the startup script and executable.

Use at your own risk. There is a tool to remove this here at Macupdate.com.