|
I scanned over the discussion thread and the claim that is has malicious behavior is still disputed. Most of what I summarize here has already been said in previous comments. SteveTX voiced the following major issues with the software: 1. the software connects to websites of financial and government institutions, and uses your PC for attacks against them. 2. It disables SSL certificate checks and allows man-in-the-middle attacks, allegedly stealing authentication credentials 3. It hooks into the web browser to disguise its behavior, and uses sophisticated compression to hide program components. The relevant posts are:
http://www.wilderssecurity.com/showpost.php?p=1514487&postcount=106
http://www.wilderssecurity.com/showpost.php?p=1516779&postcount=134 To me it seems that there is suspicious behavior but no real proof for the claims that it is actually used as a botnet to carry out attacks. In the second post (134) SteveTX actually limits his accusations to pointing out the suspicious behavior, more or less admitting that there is no proof for the alleged malicious behavior. Looking at Venom88's link to Virus Total shows that only two of the major antivirus vendors flag UltraSurf as malicious. NOD32 explicitly identifies it as Win32/UltraReach, McAfee seems to detect it only through it's heuristic engine - maybe finding the runtime compression suspicious. I personally can't make a decision based on these statements. It seems that UltraSurf is a rather sophisticated piece of software, and neither side can bring sufficient proof in its favor or agains
|
