From the article: To check whether you have the malware installed: Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_servi

From the article: To check whether you have the malware installed: Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users//Library/kernel_service”. If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”