It looks like quite a bunch of Mac users have gotten their Macs infected with a Trojan virus. How did that happen? Well they all downloaded an alleged copy of that new iLife 09 via torrent sites. 20,000 Macs have gotten the software which proved to be Trojan called OSX.Trojan.iServices.A. So here’s how the Trojan works:

When installing iWork 09, the iWorkServices package is installed. The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer’s request of an administrator password. This software is installed as a startup item (in /System/Library/StartupItems/iWorkServices, a location reserved normally for Apple startup items), where it has read-write-execute permissions for root. The malicious software connects to a remote server over the Internet; this means that a malicious user will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely. The Trojan horse may also download additional components to an infected Mac.

Here’s what you have to do to clean your system. Open Terminal and follow these steps:

1. sudo su (enter password)
2. rm -r /System/Library/StartupItems/iWorkServices
3. rm /private/tmp/.iWorkServices
4. rm /usr/bin/iWorkServices
5. rm -r /Library/Receipts/iWorkServices.pkg
6. killall -9 iWorkServices
7. Wipe, reformat and reinstall OS X from your master disc

I don’t have to tell you what we all learned from this, right children?

via macrumors

Related posts:

1. iPhone Firmware 1.1.3 Prep: A Trojan In light of the recent CES convention and next week’s...
2. Apple Released Mac OS X 10.5.6 We knew this was going to happen but we simply...
3. Apple Has Special Mac Prices this Black Friday Got your cash ready for this Black Friday? Got your...
4. Apple Unveils Near Final Mac OS X Leopard If you thought you had enough of ‘Tiger’ wait for...
5. Laugh of the Day: “I’m a PC” Commercials Were Made on a Mac The new “I’m a PC” campaign from Microsoft turned really...