Intego issued a security alert for Mac users on Thursday, advising them about the existence of a new Trojan Horse, which they've named OSX.Trojan.iServices.A. This new Trojan Horse can be found in pirated copies of Apple's iWork '09 application suite, which has been downloaded over 20,000 times, according to Intego's numbers.  When installing an infected pirated copy of iWork ‘09, an extra iWorkServices package is installed; this installation begins as soon as the user launches the iWork ‘09 installer. This package is installed as a system-wide startup item, where it has read-write permissions as root. In other words, this code can do anything to any part of the system, with full authorization. The malicious software connects to remote servers over the internet, so a malicious remote user will know that the program has been installed. The malicious user will be able to connect to the infected Mac and perform various actions; the Trojan horse may also download additional components to an infected Mac. Once infected, the clean-up process may be quite painful. As the Trojan horse has the ability to install additional components, it's not sufficient to remove the known pieces. Instead, the safest recovery method starts with a reformat and a clean install of OS X. Because the Trojan may also modify installed applications (this is possible because the Trojan is running as root), programs should be reinstalled from their master discs, not from backups. Finally, the user should copy over their data files from backups.