iThreats

I noticed that few traffics coming in are looking on how to remove “iWorkServices”.

So, here’s a manual or  ”Do It Yourself” steps: 

Open Terminal – >  /Application/Utilities/Terminal.app 

Check if “iWorkServices” is running, to do you can choose any of the options below: 

**Note: These commands requires root privileges to execute, to avoid re-entering your password everytime type – > ”sudo su“.

1. Check for “iworkservices” running process by typing “lsof -c iwork” or “lsof -c iWork“, just check which one works for you. 

Monitoring ” iWorkServices” background activity, you will notice TCP connections changes as it tries to communicate to 69.92.177.146:59201 and  qwfojzlk.freehostia.com:1024.

              1.1 If you know the PID or process ID then typing “lsof -p <PID>” will also give the same result.  

        2. Since we already confirmed the presence of this threat in the system, you could start removing them through executing the following commands:  

            rm -rf /System/Library/StartupItems/iWorkServices 

            rm /usr/bin/iWorkServices

            rm /private/tmp/.iWorkServices

            rm -rf /Library/Receipts/iWorkServices.pkg

            killall -9 iWorkServices

              2.1 Or you can copy the same instruction and make a small bash script, as exampled below:

#!/bin/bash
#This is a simple script to delete iworkservices files terminate running process
rm -rf /System/Library/StartupItems/iWorkServices
rm /usr/bin/iWorkServices
rm /private/tmp/.iWorkServices
rm -rf /Library/Receipts/iWorkServices.pkg
killall -9 iWorkServices
exit

You can write these instructions to any text editor like TextEdit (/Applications/TextEdit.app). 

Open terminal and type “chmod +rwx <filename>” as exampled below. **Notice that I am root user here, so don’t forget to type “sudo su“, so your script will execute properly.**