Checking for dpkg -l output, ps output and lsmod output should be enough to find something fishy. Wrap that to a nice UI that does string compare and finished.

Nevertheless, you first would need to find a user that actually has carrierIQ on their phone to get the positive list.