Keydnap v1.5 Removal - Courtesy of ESET

Start by quitting Transmission. Then, in Activity Monitor, kill processes with any of the following names:

• icloudproc
• License.rtf
• icloudsyncd
• /usr/libexec/icloudsyncd -launchd netlogon.bundle

Remove the following files and directories:

• /Library/Application Support/com.apple.iCloud.sync.daemon/
• /Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist
• /Users/$USER/Library/Application Support/com.apple.iCloud.sync.daemon/
• /Users/$USER/Library/Application Support/com.geticloud/
• /Users/$USER/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist
• /Users/$USER/Library/LaunchAgents/com.geticloud.icloud.photo.plist

Remove Transmission from your system and redownload it from a trusted source. The Transmission website and binaries are now hosted on Github. You can verify the hash and the signature of the legitimate binary package with:

• "shasum -a 256" and compare with the one on the site and
• "codesign -dvvv" and verify if is signed by "Digital Ignition LLC" with team identifier 5DPYRBHEAR.