Free Removal Tool Available for iWorkServices Mac Trojan

Security firms rush to aid users that may have accidentally downloaded the most recent Mac malware

Last week, various sources were reporting that pirated copies of iWork '09 doing the rounds on torrent sites were infected with a trojan. Acknowledged by security firms Intego and SecureMac, there are currently at least two solutions to rid your computer of the respective malware.


In a security note issued on January 21, 2009, Intego revealed that it had discovered a new Trojan horse threatening Mac users. Called OSX.Trojan.iServices.A, the trojan was reportedly “circulating in copies of Apple’s iWork 09 found on BitTorrent trackers and other sites containing links to pirated software,” according to the security firm. “The version of iWork 09, Apple’s productivity suite, are complete and functional, but the installer contains an additional package called iWorkServices.pkg,” Intego explained.

Intego went on to outline that “when installing iWork 09, the iWorkServices package is installed. The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer’s request of an administrator password (in older versions of Mac OS X, 10.5.1 or earlier, there will be no password request). This software is installed as a startup item (in /System/Library/StartupItems/iWorkServices, a location reserved normally for Apple startup items), where it has read-write-execute permissions for root,” said the company that develops and sells desktop Internet security and privacy software for Macintosh. From there, the malware connects to the Internet and to a remote server to which a hacker can have access. The hacker will then have the ability to connect and “perform various actions remotely,” the company warned last week.

According to a MacScan report, those who feel they might be infected can use SecureMac’s free removal tool to remove the trojan horse (available just below). Intego, for its part, has updated the virus definitions for its VirusBarrier X4 and X5 antivirus software for Mac (also available for download).

Download iWorkServices Trojan Removal Tool 1.0 (Free)

Download VirusBarrier (Update / Trial / Buy)