Keydnap v1.5 Removal - Courtesy of ESET
Start by quitting Transmission. Then, in Activity Monitor, kill processes with any of the following names:
- icloudproc
- License.rtf
- icloudsyncd
- /usr/libexec/icloudsyncd -launchd netlogon.bundle
Remove the following files and directories:
- /Library/Application Support/com.apple.iCloud.sync.daemon/
- /Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist
- /Users/$USER/Library/Application Support/com.apple.iCloud.sync.daemon/
- /Users/$USER/Library/Application Support/com.geticloud/
- /Users/$USER/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist
- /Users/$USER/Library/LaunchAgents/com.geticloud.icloud.photo.plist
Remove Transmission from your system and redownload it from a trusted source.
The Transmission website and binaries are now hosted on Github. You can verify
the hash and the signature of the legitimate binary package with:
- "shasum -a 256" and compare with the one on the site and
- "codesign -dvvv" and verify if is signed by "Digital Ignition LLC" with team
identifier 5DPYRBHEAR.