Comment by okket

Simple file check if you are infected:

  if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] || 
     [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] || 
     [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] || 
     [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] || 
     [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist" ] || 
     [ -d "/Library/Application Support/com.apple.iCloud.sync.daemon/" ] || 
     [ -f "$HOME/Library/LaunchAgents/com.geticloud.icloud.photo.plist" ]; 
  then echo "OSX/Keydnap detected.";
  else echo "You're good.";
  fi

Source: https://gist.github.com/kaizensoze/ca96d039b295db220951d42ca...