感染后的 Transmission 签名于 8 月 28 号,这几天有下载过 Transmission 的用户可以通过检查以下文件来检测自己中招与否。
(通过 Homebrew Cask 下载 Transmission 的用户应该不会中招吧,它无法通过哈希校验。)
/Applications/Transmission.app/Contents/Resources/License.rtf
/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf
$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd
$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id
$HOME/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist
/Library/Application Support/com.apple.iCloud.sync.daemon/
$HOME/Library/LaunchAgents/com.geticloud.icloud.photo.plist