OSX/iWorkS-B another Trojan affecting dodgy downloads

Image (1) cs4.jpg for post 19948

SophosLabs heard some reports today regarding another Trojan affecting dubious downloads from torrent (Intego and Graham Cluley). This Trojan, OSX/iWorkS-B, is affecting Adobe Photoshop CS4 downloads on torrent.

OSX/iWorkS-B has a similar modus operandi to OSX/iWorkS-A.

The differences mean that for the disinfection you will need to kill the service DivX instead of iWorkService.

sudo killall -9 DivX

Plus remove the folder /System/Library/StartupItems/DivX

sudo rm -rfd /System/Library/StartupItems/DivX

Network administrators who monitor network traffic should look for traffic to:


OSX/iWorkS-B is yet another reason to have a security program on a Mac.