Two-era code audit of 360 Security Guard
A follow-up audit comparing the 2006 security suite with later versions, to trace when its behaviour changed.
Credits
Earliest dated source:
The full story
This follow-up to the TTPlayer audit uses REA to compare the original 2006 installer of 360 Security Guard (360安全卫士), recovered from the Wayback Machine, with the 2026 version. The 2006 tool launched as a free anti-adware utility and later came to be widely called adware itself. The audit asks whether that change can be seen in the code.
Findings in the current version include tracking reports sent every time it blocks a pop-up, a silent browser install offered from the scan-results page, and ad settings that its servers can change remotely. It also found 142 of its 437 modules carrying installer download links, including the uninstaller. The post doubles as a reusable method for auditing Chinese software. One tip is to scan for UTF-16 text, which plain grep misses.
How it was done
Tools
Themes
Loading themes…
Sources
From the maker's own write-up or code. We summarise what they report; we haven't tested it ourselves.
- REA community: [rea-360] 360 安全卫士双年代代码审计Repository account: morlutoPublished
The two-era audit (in Chinese): method, evidence and each finding tied to a function or string.