macOS下malware移除之Qsearch变种劫持（Remove hijacking of Qsearch）

前言：
Foreword:

前几天又收到一个网友求助，说受到了Qsearch的困扰，在要求其说明大概发生现象和时间点后，按照老方法收集信息后开始分析其感染的恶意文件来源。但是按她说的时间点，始终无法找到Qsearch相关的可疑文件，而且她答复说自己已经按照文章删除了相关配置，这就比较麻烦了。因为劫持问题还一直存在，只能扩大检查范围，根据存活的进程去分析哪些有可能是恶意软件开启的，最后让其多次发送相关配置进行检测分析后才确定感染源，其实已经早在2019年就已经有相关配置，但是不知为何最近他才发现受到Qsearch的困扰。

难道是Qsearch出现新的变异或策略了？

A few days ago, I received another netizen for help, saying that I was troubled by Qsearch. After asking him to explain the approximate phenomenon and the time point, I collected the information according to the old method and began to analyze the source of the infected malicious files. But according to the time point she said, she could not find suspicious files related to Qsearch, and she replied that she had deleted the relevant configuration according to the article, which was more troublesome. Because the problem of hijacking still exists, we can only expand the scope of the inspection. According to the surviving process, we can analyze which may be activated by the malware. Finally, let it send the relevant configuration multiple times for detection and analysis to determine the source of infection. In fact, it has been as early as 2019. There have been relevant configurations for years, but I do not know why he only recently discovered that he is troubled by Qsearch.

Is there a new mutation or strategy in Qsearch?

网友的反馈截图如下：

Screenshots of feedback from some of these netizens are as follows:

最终，当然是完美解决啦，满满的幸福感！

Finally，Of course it is the perfect solution, full of happiness!