Well here comes the start of a new era
The Trojan parks itself in your /System/Library/StartupItems folder with read-write-execute root privileges—from there it can phone home to a remote server and install additional nasties throughout your system. Right now, the only true fix is a full format and re-install, since its residual pieces can be spread far and wide. You can spot if your particular warez iWork is infected by searching for the iWorkServices.pkg inside the installer.
Comment